bugtraq - [ MDVSA-2008:058 ] - Updated openldap packages fix multiple vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-id: <E1JWzLl-0004eE-Fd@artemis.annvix.ca>
Date: Wed, 05 Mar 2008 12:32:25 -0700
From: security@...driva.com
To: bugtraq@...urityfocus.com
Subject: [ MDVSA-2008:058 ] - Updated openldap packages fix multiple
 vulnerabilities


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________
 
 Mandriva Linux Security Advisory                         MDVSA-2008:058
 http://www.mandriva.com/security/
 _______________________________________________________________________
 
 Package : openldap
 Date    : March 5, 2008
 Affected: 2007.0, 2007.1, 2008.0, Corporate 4.0
 _______________________________________________________________________
 
 Problem Description:
 
 A vulnerability was found in slapo-pcache in slapd of OpenLDAP prior
 to 2.3.39 when running as a proxy-caching server.  It would allocate
 memory using a malloc variant rather than calloc, which prevented
 an array from being properly initialized and could possibly allow
 attackers to cause a denial of service (CVE-2007-5708).
 
 Two vulnerabilities were found in how slapd handled modify (prior
 to 2.3.26) and modrdn (prior to 2.3.29) requests with NOOP control
 on objects stored in the BDB backend.  An authenticated user with
 permission to perform modify (CVE-2007-6698) or modrdn (CVE-2008-0658)
 operations could cause slapd to crash.
 
 The updated packages have been patched to correct these issues.
 _______________________________________________________________________

 References:
 
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5708
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6698
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0658
 _______________________________________________________________________
 
 Updated Packages:
 
 Mandriva Linux 2007.0:
 d4427f6f960dceb0a54887395688b02d  2007.0/i586/libldap2.3_0-2.3.27-2.2mdv2007.0.i586.rpm
 fb96499f3a33a20274b95ae1fe986938  2007.0/i586/libldap2.3_0-devel-2.3.27-2.2mdv2007.0.i586.rpm
 0fe0f9a22d5a3d2b8d07170f7e02c360  2007.0/i586/libldap2.3_0-static-devel-2.3.27-2.2mdv2007.0.i586.rpm
 248f3a65f570e22b7d1ec67e95a0249e  2007.0/i586/openldap-2.3.27-2.2mdv2007.0.i586.rpm
 0ecb5d940de1ec31b1191110d3b40e4e  2007.0/i586/openldap-clients-2.3.27-2.2mdv2007.0.i586.rpm
 43170f54bac53b30c6129b07253ab7f6  2007.0/i586/openldap-doc-2.3.27-2.2mdv2007.0.i586.rpm
 16a103849faddc8b9e300bd7738b5bde  2007.0/i586/openldap-servers-2.3.27-2.2mdv2007.0.i586.rpm 
 53476478b042cbbbb2e59edf5a2ff330  2007.0/SRPMS/openldap-2.3.27-2.2mdv2007.0.src.rpm

 Mandriva Linux 2007.0/X86_64:
 eb36e1526f2b3a3a03271edf66d2cca4  2007.0/x86_64/lib64ldap2.3_0-2.3.27-2.2mdv2007.0.x86_64.rpm
 6b37c2ee41eb94cb65ec40d551538022  2007.0/x86_64/lib64ldap2.3_0-devel-2.3.27-2.2mdv2007.0.x86_64.rpm
 6f009e31ac35621ffa9247501d583ed1  2007.0/x86_64/lib64ldap2.3_0-static-devel-2.3.27-2.2mdv2007.0.x86_64.rpm
 445fb7aeb7818f0358659c91fb8ada70  2007.0/x86_64/openldap-2.3.27-2.2mdv2007.0.x86_64.rpm
 3cc4725e66a377e07e908f48ee149acb  2007.0/x86_64/openldap-clients-2.3.27-2.2mdv2007.0.x86_64.rpm
 c5ba86642d7c9e6f3fe51d1201f9596c  2007.0/x86_64/openldap-doc-2.3.27-2.2mdv2007.0.x86_64.rpm
 13f4514be8c8f989cc4a1537ec8f8177  2007.0/x86_64/openldap-servers-2.3.27-2.2mdv2007.0.x86_64.rpm 
 53476478b042cbbbb2e59edf5a2ff330  2007.0/SRPMS/openldap-2.3.27-2.2mdv2007.0.src.rpm

 Mandriva Linux 2007.1:
 7cc3081ddcfd3db452d2e90036e3a628  2007.1/i586/libldap2.3_0-2.3.34-5.2mdv2007.1.i586.rpm
 fbc6f5333b7ca7796d95e8a3718f164a  2007.1/i586/libldap2.3_0-devel-2.3.34-5.2mdv2007.1.i586.rpm
 e7d258fa40a2a5c52314c856b3bc4fc1  2007.1/i586/libldap2.3_0-static-devel-2.3.34-5.2mdv2007.1.i586.rpm
 589ef40a1af243f7664965fe090f7de2  2007.1/i586/openldap-2.3.34-5.2mdv2007.1.i586.rpm
 ce64d22f74a555746a408d86ab5c24cb  2007.1/i586/openldap-clients-2.3.34-5.2mdv2007.1.i586.rpm
 35e5939274493799d93f2eca1388420a  2007.1/i586/openldap-doc-2.3.34-5.2mdv2007.1.i586.rpm
 4dd84314508659366aaf95027f37896d  2007.1/i586/openldap-servers-2.3.34-5.2mdv2007.1.i586.rpm
 1117b03409884c7799a1f7fd4ac29725  2007.1/i586/openldap-testprogs-2.3.34-5.2mdv2007.1.i586.rpm
 67f80a1770d45f7e7e294bd8ec92846e  2007.1/i586/openldap-tests-2.3.34-5.2mdv2007.1.i586.rpm 
 a686ce5b015b7accd63d327a0f898d84  2007.1/SRPMS/openldap-2.3.34-5.2mdv2007.1.src.rpm

 Mandriva Linux 2007.1/X86_64:
 d47695976ba1bb63169509da41e57e07  2007.1/x86_64/lib64ldap2.3_0-2.3.34-5.2mdv2007.1.x86_64.rpm
 e6223017fb3b35792e680db1203aca6c  2007.1/x86_64/lib64ldap2.3_0-devel-2.3.34-5.2mdv2007.1.x86_64.rpm
 320f8173708590828f70b4995d8ef2a8  2007.1/x86_64/lib64ldap2.3_0-static-devel-2.3.34-5.2mdv2007.1.x86_64.rpm
 3b008b7ed26ea10234a13289e84f9388  2007.1/x86_64/openldap-2.3.34-5.2mdv2007.1.x86_64.rpm
 c158c817b74e2c1e678e8d34fef24a0e  2007.1/x86_64/openldap-clients-2.3.34-5.2mdv2007.1.x86_64.rpm
 7b457f83f95361b82e3340cdbc5dcff1  2007.1/x86_64/openldap-doc-2.3.34-5.2mdv2007.1.x86_64.rpm
 fde2e695d34441ae77714de0fb42d1ba  2007.1/x86_64/openldap-servers-2.3.34-5.2mdv2007.1.x86_64.rpm
 96715702c27b99497c5ec7aa917fb586  2007.1/x86_64/openldap-testprogs-2.3.34-5.2mdv2007.1.x86_64.rpm
 f55189544f96a7de67af997eae52631b  2007.1/x86_64/openldap-tests-2.3.34-5.2mdv2007.1.x86_64.rpm 
 a686ce5b015b7accd63d327a0f898d84  2007.1/SRPMS/openldap-2.3.34-5.2mdv2007.1.src.rpm

 Mandriva Linux 2008.0:
 50d197a5004773e80a4fa3fbf64f683b  2008.0/i586/libldap2.3_0-2.3.38-3.2mdv2008.0.i586.rpm
 3fb1cbd91ce0b520f1185883ba6631e4  2008.0/i586/libldap2.3_0-devel-2.3.38-3.2mdv2008.0.i586.rpm
 e6afb970700d63e982fb62108a5483af  2008.0/i586/libldap2.3_0-static-devel-2.3.38-3.2mdv2008.0.i586.rpm
 bbdc4dc9929c911d63638833b636da11  2008.0/i586/openldap-2.3.38-3.2mdv2008.0.i586.rpm
 21ba24d4b6f8b09f7870e94c983e5706  2008.0/i586/openldap-clients-2.3.38-3.2mdv2008.0.i586.rpm
 8b12e3e7f72ca68c7839a4deccbd8781  2008.0/i586/openldap-doc-2.3.38-3.2mdv2008.0.i586.rpm
 04abf0a21b507a3626667f4bc7755738  2008.0/i586/openldap-servers-2.3.38-3.2mdv2008.0.i586.rpm
 fd6652cb4645b22b77afaa5e7d46c5b8  2008.0/i586/openldap-testprogs-2.3.38-3.2mdv2008.0.i586.rpm
 14690bfcbf5c3cbaf9f34e86fe812d58  2008.0/i586/openldap-tests-2.3.38-3.2mdv2008.0.i586.rpm 
 d04ebbb872eecb60934dbda7ad8cc310  2008.0/SRPMS/openldap-2.3.38-3.2mdv2008.0.src.rpm

 Mandriva Linux 2008.0/X86_64:
 e743f1c46812c62178d82792e78580b3  2008.0/x86_64/lib64ldap2.3_0-2.3.38-3.2mdv2008.0.x86_64.rpm
 02a8a95838044337c7c2813b2b6158cb  2008.0/x86_64/lib64ldap2.3_0-devel-2.3.38-3.2mdv2008.0.x86_64.rpm
 4497a989916bda44db6bd5ce93373907  2008.0/x86_64/lib64ldap2.3_0-static-devel-2.3.38-3.2mdv2008.0.x86_64.rpm
 a0c92471258de04a589a651bd571ece6  2008.0/x86_64/openldap-2.3.38-3.2mdv2008.0.x86_64.rpm
 16268ccf7f5fbc375c4fd8313bd389de  2008.0/x86_64/openldap-clients-2.3.38-3.2mdv2008.0.x86_64.rpm
 72de58e66a16f68212bff5fb899cf44c  2008.0/x86_64/openldap-doc-2.3.38-3.2mdv2008.0.x86_64.rpm
 7510f04c21750fca734ad4bd9c0b336e  2008.0/x86_64/openldap-servers-2.3.38-3.2mdv2008.0.x86_64.rpm
 353a580e2280b765e99906cd598f641a  2008.0/x86_64/openldap-testprogs-2.3.38-3.2mdv2008.0.x86_64.rpm
 1170527a0621b41bb9257bb3e1922dc1  2008.0/x86_64/openldap-tests-2.3.38-3.2mdv2008.0.x86_64.rpm 
 d04ebbb872eecb60934dbda7ad8cc310  2008.0/SRPMS/openldap-2.3.38-3.2mdv2008.0.src.rpm

 Corporate 4.0:
 4f14a96268be28e1a5b486e153080ff8  corporate/4.0/i586/libldap2.3_0-2.3.27-1.4.20060mlcs4.i586.rpm
 00a834b2fa4941e2c1a4a58c6c034df6  corporate/4.0/i586/libldap2.3_0-devel-2.3.27-1.4.20060mlcs4.i586.rpm
 b21351bf410ad80dd2165cd680ec5512  corporate/4.0/i586/libldap2.3_0-static-devel-2.3.27-1.4.20060mlcs4.i586.rpm
 f76ddc4f7daef7163d2b6ae3dc159bfa  corporate/4.0/i586/openldap-2.3.27-1.4.20060mlcs4.i586.rpm
 4f39a60ebc0f10b448249a6fd391881a  corporate/4.0/i586/openldap-clients-2.3.27-1.4.20060mlcs4.i586.rpm
 56c6a71605ef78d91f39764a6bd5805c  corporate/4.0/i586/openldap-doc-2.3.27-1.4.20060mlcs4.i586.rpm
 278c5076219f41b620fe4be209b560f6  corporate/4.0/i586/openldap-servers-2.3.27-1.4.20060mlcs4.i586.rpm 
 2ae4d3fde1ca0cdc2718edba0ed5caa7  corporate/4.0/SRPMS/openldap-2.3.27-1.4.20060mlcs4.src.rpm

 Corporate 4.0/X86_64:
 001e7ac83e8b0f4bd786c7a34b18bc6f  corporate/4.0/x86_64/lib64ldap2.3_0-2.3.27-1.4.20060mlcs4.x86_64.rpm
 3a383bce15adeb349f2cbc2e2e09e617  corporate/4.0/x86_64/lib64ldap2.3_0-devel-2.3.27-1.4.20060mlcs4.x86_64.rpm
 fb829cc7b376913774f7e17f63126ea7  corporate/4.0/x86_64/lib64ldap2.3_0-static-devel-2.3.27-1.4.20060mlcs4.x86_64.rpm
 8cf4600913c6f0480dcb4a83a2caf97e  corporate/4.0/x86_64/openldap-2.3.27-1.4.20060mlcs4.x86_64.rpm
 ebee2e465a241aef5a6317dff68cf939  corporate/4.0/x86_64/openldap-clients-2.3.27-1.4.20060mlcs4.x86_64.rpm
 b27b946152945b36385ed80cfaca5960  corporate/4.0/x86_64/openldap-doc-2.3.27-1.4.20060mlcs4.x86_64.rpm
 e567e790d1ae957531f899cb6fc766cf  corporate/4.0/x86_64/openldap-servers-2.3.27-1.4.20060mlcs4.x86_64.rpm 
 2ae4d3fde1ca0cdc2718edba0ed5caa7  corporate/4.0/SRPMS/openldap-2.3.27-1.4.20060mlcs4.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (GNU/Linux)

iD4DBQFHzsnrmqjQ0CJFipgRAjZAAKCvb4GW3/uY7uLIBuTkI5eqiVzkOACY0HKn
tOFiQm6cMHQ8KwyDVlpFDA==
=lnDg
-----END PGP SIGNATURE-----