Several security vulnerabilities have been discovered in Directory Server:1) a shell command injection flaw in the Red Hat Administration Server replication monitor CGI script used by Red Hat Directory Server 8.0; and2) the Red Hat Administration Server does not properly restrict access to CGI scripts. The risk is MEDIUM. An attacker with access to the replication monitor web page could execute arbitrary shell commands with the privileges of the Administration Server and an unauthenticated remote user with access to the TCP port used by the Administration Server could access information or perform certain tasks that should have been restricted to Directory Server administrative users.


More...