openSUSE Leap 16.0 389 Directory Server Unauthenticated Code Execution — Patch Advisory 2026-21950-1 Now

---
title: 389 Directory Server Process Spawning Shell or Interpreter
id: 3f8a2c41-7b9e-4d12-a6f3-9c1e2d5b8a07
status: experimental
description: Detects ns-slapd (389 Directory Server daemon) spawning a shell, scripting interpreter, or common post-exploitation binary — a strong indicator of successful code execution against the directory service.
references:
  - https://linuxsecurity.com/advisories/opensuse/opensuse-2026-21950-1-389-ds
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.004
  - attack.exploitation_for_privilege_escalation
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/ns-slapd'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/socat'
  condition: selection_parent and selection_child
falsepositives:
  - 389-ds monitoring or backup wrappers legitimately invoked by the service account (verify exact command lines)
level: critical
---
title: Directory Service Account Writing Executable Content to Temp or Web Paths
id: 8c4d1e96-2a47-4b83-9e15-6f3a7c2d1b49
status: experimental
description: Detects file creation by the dirsrv/ldap service user in world-writable or web-served directories, consistent with payload staging after 389-ds compromise.
references:
  - https://linuxsecurity.com/advisories/opensuse/opensuse-2026-21950-1-389-ds
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1105
logsource:
  category: file_event
  product: linux
detection:
  selection_user:
    User:
      - 'dirsrv'
      - 'ldap'
  selection_path:
    TargetFilename|startswith:
      - '/tmp/'
      - '/var/tmp/'
      - '/dev/shm/'
      - '/srv/www/'
      - '/var/www/'
  condition: selection_user and selection_path
falsepositives:
  - Rare; 389-ds operational writes are confined to /var/lib/dirsrv and /etc/dirsrv
level: high
---
title: High-Volume Unauthenticated LDAP Binds or Anonymous Operations
id: 5b2e7d38-1c6a-4f49-a3d2-8e9b4f7c1a63
status: experimental
description: Detects bursts of anonymous LDAP operations or bind failures against a directory server, potentially indicating exploitation attempts against a pre-authentication flaw in 389-ds.
references:
  - https://linuxsecurity.com/advisories/opensuse/opensuse-2026-21950-1-389-ds
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|endswith: '/ns-slapd'
    DestinationPort:
      - 389
      - 636
      - 9830
    Initiated: 'false'
  condition: selection
falsepositives:
  - Normal client LDAP traffic — deploy with a threshold/aggregation (e.g. >100 connections from a single non-service source in 5 minutes)
level: medium

// Hunt: 389-ds exploitation indicators — shell spawn, suspicious writes, anonymous LDAP spikes
// Requires Syslog/CEF ingestion from openSUSE Leap 16.0 directory servers
union withsource=tt (
    Syslog
    | where Computer has_any ("ldap", "dirsrv", "idm", "ds")
    | where SyslogMessage has_any ("ns-slapd", "389-ds")
    | where SyslogMessage has_any ("anonymous", "bind", "err=49", "unauthenticated")
    | summarize EventCount = count() by Computer, bin(TimeGenerated, 5m)
    | where EventCount > 100
    | project TimeGenerated, Computer, EventCount, Indicator = "Anonymous/pre-auth LDAP burst"
),
(
    DeviceProcessEvents
    | where InitiatingProcessFileName =~ "ns-slapd"
    | where FileName in~ ("sh", "bash", "dash", "python", "python3", "perl", "curl", "wget", "nc", "ncat", "socat")
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, Indicator = "ns-slapd spawned shell/interpreter"
),
(
    DeviceNetworkEvents
    | where InitiatingProcessFileName =~ "ns-slapd"
    | where ActionType == "ConnectionSuccess" and not(RemoteIP startswith "10." or RemoteIP startswith "192.168." or RemoteIP startswith "172.16.")
    | project TimeGenerated, DeviceName, RemoteIP, RemotePort, Indicator = "Outbound connection from directory daemon"
)
| order by TimeGenerated desc

-- Artifact: SecurityArsenal.Hunt.389DS.Triage
-- Purpose: Identify 389-ds hosts, package version, anomalous child processes, and outbound connections

-- Query 1: Running ns-slapd processes with full command lines
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ 'ns-slapd'
   OR Exe =~ 'dirsrv'

-- Query 2: Shell or interpreter children of ns-slapd (post-exploitation indicator)
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Ppid IN (
    SELECT Pid FROM pslist() WHERE Name =~ 'ns-slapd'
)
AND Name =~ '(sh|bash|dash|python|perl|curl|wget|nc|ncat|socat)'

-- Query 3: Files written by service user into staging paths
SELECT FullPath, Size, Mtime, Atime
FROM glob(globs=['/tmp/*', '/var/tmp/*', '/dev/shm/*'])
WHERE NOT IsDir
  AND Mtime > timestamp(epoch=now() - 86400*3)

-- Query 4: Outbound connections from the directory daemon
SELECT Pid, Name, LocalAddr, LocalPort, RemoteAddr, RemotePort, Status
FROM netstat()
WHERE Name =~ 'ns-slapd'
  AND Status =~ 'ESTABLISHED'

#!/usr/bin/env bash
# 389-ds remediation for openSUSE Leap 16.0 — SUSE advisory 2026-21950-1
# Run as root on each directory server. Test in staging before production.

set -euo pipefail

echo "[+] Current 389-ds package versions:"
rpm -qa | grep -i '389' || echo "    No 389-ds packages found — host not affected."

echo "[+] Refreshing repositories and applying security updates..."
zypper refresh
zypper update -y 389-ds 389-ds-base cockpit-389-ds 2>/dev/null || zypper patch -y --category security

echo "[+] Restarting directory service instances..."
for inst in $(dscreate dsctl list 2>/dev/null | awk '{print $1}' || true); do
    dsctl "$inst" restart && echo "    Restarted: $inst"
done

echo "[+] Post-patch verification:"
rpm -qa | grep -i '389'
echo "[+] Service status:"
systemctl list-units 'dirsrv@*' --no-pager

echo "[+] Checking ns-slapd for anomalous child processes (last check):"
pgrep -a -P "$(pgrep ns-slapd | head -1)" 2>/dev/null || echo "    No child processes — clean."

echo "[+] Confirm listener is bound only to expected interfaces:"
ss -lntp | grep -E ':(389|636|9830)\s'

echo "[DONE] Reboot is not required, but validate LDAP binds from dependent services."