Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2001.335 -- Debian Security Advisory DSA-068-1 OpenLDAP DoS 14 August 2001 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: openldap Vendor: Debian Operating System: Debian GNU/Linux 2.2 Linux Unix Platform: Alpha ARM i386 Motorola 680x0 PowerPC Sparc Impact: Denial of Service Access Required: Remote Ref: AA-2001.04 - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- - - ------------------------------------------------------------------------ Debian Security Advisory DSA-068-1 security@debian.org http://www.debian.org/security/ Wichert Akkerman August 9, 2001 - - ------------------------------------------------------------------------ Package : openldap Problem type : remote DoS Debian-specific: no CERT released their advisory CA-2001-18 which lists a number of vulnerabilities in various LDAP implementations. based on the results of the PROTOS LDAPv3 test suite. These tests found one problem in OpenLDAP, a free LDAP implementation that is shipped as part of Debian GNU/Linux 2.2. The problem is that slapd did not handle packets with an invalid BER length of length fields and would crash if it received those. An attacked can use this to mount a denial of service attack remotely. This problem has been fixed in version 1.2.11-1, and we recommend that you upgrade your slapd package immediately. wget url will fetch the file for you dpkg -i file.deb will install the referenced file. Debian GNU/Linux 2.2 alias potato - - --------------------------------- Potato was released for alpha, arm, i386, m68k, powerpc and sparc. Source archives: http://security.debian.org/dists/stable/updates/main/source/openldap_1.2.12-1.dsc MD5 checksum: b504c90a83025dc6a916187ddabf792a http://security.debian.org/dists/stable/updates/main/source/openldap_1.2.12-1.tar.gz MD5 checksum: 651c7995d73e4450568f8c43b556b38d Architecture independent archives: http://security.debian.org/dists/stable/updates/main/binary-all/ldap-rfc_1.2.12-1_all.deb MD5 checksum: be2f6eb1965dc7b34149bc6518f74e58 http://security.debian.org/dists/stable/updates/main/binary-all/libopenldap-runtime_1.2.12-1_all.deb MD5 checksum: 6f1031e6e83f2fbb70a01084add8a1db ARM architecture: http://security.debian.org/dists/stable/updates/main/binary-arm/libopenldap-dev_1.2.12-1_arm.deb MD5 checksum: dbcfe982fe36fb41ac27f3c3f06423b8 http://security.debian.org/dists/stable/updates/main/binary-arm/libopenldap1_1.2.12-1_arm.deb MD5 checksum: d1fca5f66dbffd5240049f5b15960e6a http://security.debian.org/dists/stable/updates/main/binary-arm/openldap-gateways_1.2.12-1_arm.deb MD5 checksum: c20e3f096ec42a553b4d3b999aff4676 http://security.debian.org/dists/stable/updates/main/binary-arm/openldap-utils_1.2.12-1_arm.deb MD5 checksum: aff72b6641b7b3fad9875104b0684bbe http://security.debian.org/dists/stable/updates/main/binary-arm/openldapd_1.2.12-1_arm.deb MD5 checksum: 6127f3c0fc228daedbb511f9310d3ce7 Alpha architecture: http://security.debian.org/dists/stable/updates/main/binary-alpha/libopenldap-dev_1.2.12-1_alpha.deb MD5 checksum: 6109c93d8c9c6dd35d6d0ec97126277a http://security.debian.org/dists/stable/updates/main/binary-alpha/libopenldap1_1.2.12-1_alpha.deb MD5 checksum: f9de7d3a6fae1e7480ac38693cc54620 http://security.debian.org/dists/stable/updates/main/binary-alpha/openldap-gateways_1.2.12-1_alpha.deb MD5 checksum: 01f7970379df0e81324f3c0f23d42693 http://security.debian.org/dists/stable/updates/main/binary-alpha/openldap-utils_1.2.12-1_alpha.deb MD5 checksum: d3469131b4b1064abcd0fb1901ff724f http://security.debian.org/dists/stable/updates/main/binary-alpha/openldapd_1.2.12-1_alpha.deb MD5 checksum: 22bfe11e0129548734ed7d93dc5e981e Intel IA-32 architecture: http://security.debian.org/dists/stable/updates/main/binary-i386/libopenldap-dev_1.2.12-1_i386.deb MD5 checksum: f38364b6f9b3a5089d58a792d0daca0a http://security.debian.org/dists/stable/updates/main/binary-i386/libopenldap1_1.2.12-1_i386.deb MD5 checksum: 00d96465ef85947015775996b44680b5 http://security.debian.org/dists/stable/updates/main/binary-i386/openldap-gateways_1.2.12-1_i386.deb MD5 checksum: 3fa22bee43b35864d82fdb8e5118aeb5 http://security.debian.org/dists/stable/updates/main/binary-i386/openldap-utils_1.2.12-1_i386.deb MD5 checksum: 0af27bf23ef1310c4f74f574ce11b1af http://security.debian.org/dists/stable/updates/main/binary-i386/openldapd_1.2.12-1_i386.deb MD5 checksum: fdf3b4c4fd3180470741128d06374c1e Motorola 680x0 architecture: http://security.debian.org/dists/stable/updates/main/binary-m68k/libopenldap-dev_1.2.12-1_m68k.deb MD5 checksum: 8aed132786db3d12f611f0a3afc5a6c2 http://security.debian.org/dists/stable/updates/main/binary-m68k/libopenldap1_1.2.12-1_m68k.deb MD5 checksum: b58d824141a544a3e1df5fe02ae96274 http://security.debian.org/dists/stable/updates/main/binary-m68k/openldap-gateways_1.2.12-1_m68k.deb MD5 checksum: de25fa556977ad1fb5d474c6b5029427 http://security.debian.org/dists/stable/updates/main/binary-m68k/openldap-utils_1.2.12-1_m68k.deb MD5 checksum: bba46b697ab1e70803f1527284344b3f http://security.debian.org/dists/stable/updates/main/binary-m68k/openldapd_1.2.12-1_m68k.deb MD5 checksum: 8bc7e0c915a28ebaab589ed5fa4dd601 PowerPC architecture: http://security.debian.org/dists/stable/updates/main/binary-powerpc/libopenldap-dev_1.2.12-1_powerpc.deb MD5 checksum: 30cf58da153851a7393df83f5765e8eb http://security.debian.org/dists/stable/updates/main/binary-powerpc/libopenldap1_1.2.12-1_powerpc.deb MD5 checksum: 9c8a2df3a2e5dbead38ce04fa82a307f http://security.debian.org/dists/stable/updates/main/binary-powerpc/openldap-gateways_1.2.12-1_powerpc.deb MD5 checksum: 64859231a0e753b774ab6142977a8940 http://security.debian.org/dists/stable/updates/main/binary-powerpc/openldap-utils_1.2.12-1_powerpc.deb MD5 checksum: ed8d8f3309111ce8181db4bd4ce83960 http://security.debian.org/dists/stable/updates/main/binary-powerpc/openldapd_1.2.12-1_powerpc.deb MD5 checksum: 5a1bbd5a875db731ecc0d3abc8707ad9 Sun Sparc architecture: http://security.debian.org/dists/stable/updates/main/binary-sparc/libopenldap-dev_1.2.12-1_sparc.deb MD5 checksum: c9f0dbbe70c2b9922fa327ed77a60933 http://security.debian.org/dists/stable/updates/main/binary-sparc/libopenldap1_1.2.12-1_sparc.deb MD5 checksum: c54dd0d7370ba9aec444e91ddab76d51 http://security.debian.org/dists/stable/updates/main/binary-sparc/openldap-gateways_1.2.12-1_sparc.deb MD5 checksum: bf37a70edf4962d98ad4ca72d9c45a5d http://security.debian.org/dists/stable/updates/main/binary-sparc/openldap-utils_1.2.12-1_sparc.deb MD5 checksum: aed5adf8a7b4ce89c4b693591190f1d1 http://security.debian.org/dists/stable/updates/main/binary-sparc/openldapd_1.2.12-1_sparc.deb MD5 checksum: 5373ae34853af6ae6d746574d3c1a9ec These packages will be moved into the stable distribution on its next revision. For not yet released architectures please refer to the appropriate directory ftp://ftp.debian.org/debian/dists/sid/binary-$arch/ . - - -- - - ---------------------------------------------------------------------------- apt-get: deb http://security.debian.org/ stable/updates main dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list: debian-security-announce@lists.debian.org - -----BEGIN PGP SIGNATURE----- Version: 2.6.3ia Charset: noconv iQB1AwUBO3LSk6jZR/ntlUftAQGuqgL/R0JT646vRcAF/OOZ4vsV5DwfacNHvHZl gJyN5ZNLeJi0RGMvN9//ACgQaspsK+MnSLi6XBqNkDooDZwS27ppWShtTQDgmnHD wWe+GyQ37/dcdGvc2Ob1TFuuCuXnRDdO =hKEv - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to use any or all of this information is the responsibility of each user or organisation, and should be done so in accordance with site policies and procedures. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the original authors to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: http://www.auscert.org.au/Information/advisories.html If you believe that your system has been compromised, contact AusCERT or your representative in FIRST (Forum of Incident Response and Security Teams). Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for emergencies. -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv Comment: ftp://ftp.auscert.org.au/pub/auscert/AUSCERT_PGP.key iQCVAwUBO3j7/Ch9+71yA2DNAQFm7QP/Y/9xDyzhg3qbbuFJ/GrVxqpAtlwrm5zA VFO4t5RK8Oqd5gpeQyA+OBVYKVCJdWUMT9lmU/5CUeawP7GaPG1txhiA+/r3ZZTR nnQCOEBq/6D3vSh/udirWBrPWew2+qHyDkaVlxxJxTPlHoDFPts+GRykW+hly1P9 mfehyMzIfvg= =hov2 -----END PGP SIGNATURE-----