CVE-2019-1010283: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: Univention Corporate Server univention-directory-notifier 12.0.1-3 and earlier is affected by: CWE-213: Intentional Information Exposure. The impact is: Loss of Confidentiality. The component is: function data_on_connection() in src/callback.c. The attack vector is: network connectivity. The fixed version is: 12.0.1-4 and later.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 7.5
Published: 2019-07-17T21:15Z
Repository: https://github.com/univention/univention-corporate-server
Language: Other
Files changed: management/univention-directory-notifier/debian/changelog, management/univention-directory-notifier/src/callback.c
Commit date: 2019-02-13 10:39:35 +0100
Commit message: Bug #48427 UDN: Forbid vulnerable GET_DN for VERSION >= 3

UDL using PROTOCOL_3 must no longer use GET_DN but WAIT_DN - if it is
still used this is a protocol violation. UDL simply will not get an
answer.

When UCRV 'notifier/protocol/version is set to 3, any old client still
using PROTOCOL_2 will get rejected while negotiating the protocol
version, so it is asserted that "version >= network_procotol_version".

Diff: diff --git a/management/univention-directory-notifier/debian/changelog b/management/univention-directory-notifier/debian/changelog
index 80faf0fff8..963a9b34b4 100644
--- a/management/univention-directory-notifier/debian/changelog
+++ b/management/univention-directory-notifier/debian/changelog
@@ -1,5 +1,11 @@
+univention-directory-notifier (12.0.1-11) unstable; urgency=low
+
+  * Bug #48427: Forbid vulnerable GET_DN for VERSION >= 3
+
+ -- Philipp Hahn <hahn@univention.de>  Wed, 13 Feb 2019 10:23:12 +0100
+
 univention-directory-notifier (12.0.1-10) unstable; urgency=low
 
   * Bug #48427: Change import limits
 
  -- Philipp Hahn <hahn@univention.de>  Fri, 08 Feb 2019 08:32:06 +0100
diff --git a/management/univention-directory-notifier/src/callback.c b/management/univention-directory-notifier/src/callback.c
index 151e50e7ce..9c6e80401a 100644
--- a/management/univention-directory-notifier/src/callback.c
+++ b/management/univention-directory-notifier/src/callback.c
@@ -197,11 +197,11 @@ int data_on_connection(int fd, callback_remove_handler remove)
 			}
 
 			p+=strlen(network_line);
 
 
-		} else if ( !strncmp(network_line, "GET_DN ", strlen("GET_DN ")) && msg_id != UINT32_MAX && network_client_get_version(fd) > 0) {
+		} else if ( !strncmp(network_line, "GET_DN ", strlen("GET_DN ")) && msg_id != UINT32_MAX && version > PROTOCOL_UNKNOWN && version < PROTOCOL_3) {
 
 			univention_debug(UV_DEBUG_TRANSFILE, UV_DEBUG_ALL, "RECV: GET_DN");
 
 			id=strtoul(&(network_line[strlen("GET_DN ")]), NULL, 10);
 

Vulnerable code: 		} else if ( !strncmp(network_line, "GET_DN ", strlen("GET_DN ")) && msg_id != UINT32_MAX && network_client_get_version(fd) > 0) {
Fixed code: univention-directory-notifier (12.0.1-11) unstable; urgency=low

  * Bug #48427: Forbid vulnerable GET_DN for VERSION >= 3

 -- Philipp Hahn <hahn@univention.de>  Wed, 13 Feb 2019 10:23:12 +0100

		} else if ( !strncmp(network_line, "GET_DN ", strlen("GET_DN ")) && msg_id != UINT32_MAX && version > PROTOCOL_UNKNOWN && version < PROTOCOL_3) {