ns-slapd in 389 Directory Server before 1.3.0.8 allows remote attackers to cause a denial of service via a crafted Distinguished Name in a MOD operation request. 389 Directory Server does not properly restrict access to entity attributes, which allows remote authenticated users to obtain sensitive information via a search query for the attribute.