Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2014.0237
Moderate: openldap security update
25 February 2014
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: openldap
Publisher: Red Hat
Operating System: Red Hat Enterprise Linux Server 5
Red Hat Enterprise Linux WS/Desktop 5
Impact/Access: Denial of Service -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2013-4449
Reference: ESB-2014.0140
Original Bulletin:
https://rhn.redhat.com/errata/RHSA-2014-0206.html
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: openldap security update
Advisory ID: RHSA-2014:0206-01
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2014-0206.html
Issue date: 2014-02-24
CVE Names: CVE-2013-4449
=====================================================================
1. Summary:
Updated openldap packages that fix one security issue are now available for
Red Hat Enterprise Linux 5.
The Red Hat Security Response Team has rated this update as having Moderate
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.
2. Relevant releases/architectures:
RHEL Desktop Workstation (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
3. Description:
OpenLDAP is an open source suite of Lightweight Directory Access Protocol
(LDAP) applications and development tools. LDAP is a set of protocols used
to access and maintain distributed directory information services over an
IP network. The openldap package contains configuration files, libraries,
and documentation for OpenLDAP.
A denial of service flaw was found in the way the OpenLDAP server daemon
(slapd) performed reference counting when using the rwm (rewrite/remap)
overlay. A remote attacker able to query the OpenLDAP server could use this
flaw to crash the server by immediately unbinding from the server after
sending a search request. (CVE-2013-4449)
Red Hat would like to thank Michael Vishchers from Seven Principles AG for
reporting this issue.
All openldap users are advised to upgrade to these updated packages, which
contain a backported patch to correct this issue.
4. Solution:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1019490 - CVE-2013-4449 openldap: segfault on certain queries with rwm overlay
6. Package List:
Red Hat Enterprise Linux Desktop (v. 5 client):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/openldap-2.3.43-27.el5_10.src.rpm
i386:
compat-openldap-2.3.43_2.2.29-27.el5_10.i386.rpm
openldap-2.3.43-27.el5_10.i386.rpm
openldap-clients-2.3.43-27.el5_10.i386.rpm
openldap-debuginfo-2.3.43-27.el5_10.i386.rpm
x86_64:
compat-openldap-2.3.43_2.2.29-27.el5_10.i386.rpm
compat-openldap-2.3.43_2.2.29-27.el5_10.x86_64.rpm
openldap-2.3.43-27.el5_10.i386.rpm
openldap-2.3.43-27.el5_10.x86_64.rpm
openldap-clients-2.3.43-27.el5_10.x86_64.rpm
openldap-debuginfo-2.3.43-27.el5_10.i386.rpm
openldap-debuginfo-2.3.43-27.el5_10.x86_64.rpm
RHEL Desktop Workstation (v. 5 client):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/openldap-2.3.43-27.el5_10.src.rpm
i386:
openldap-debuginfo-2.3.43-27.el5_10.i386.rpm
openldap-devel-2.3.43-27.el5_10.i386.rpm
openldap-servers-2.3.43-27.el5_10.i386.rpm
openldap-servers-overlays-2.3.43-27.el5_10.i386.rpm
openldap-servers-sql-2.3.43-27.el5_10.i386.rpm
x86_64:
openldap-debuginfo-2.3.43-27.el5_10.i386.rpm
openldap-debuginfo-2.3.43-27.el5_10.x86_64.rpm
openldap-devel-2.3.43-27.el5_10.i386.rpm
openldap-devel-2.3.43-27.el5_10.x86_64.rpm
openldap-servers-2.3.43-27.el5_10.x86_64.rpm
openldap-servers-overlays-2.3.43-27.el5_10.x86_64.rpm
openldap-servers-sql-2.3.43-27.el5_10.x86_64.rpm
Red Hat Enterprise Linux (v. 5 server):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/openldap-2.3.43-27.el5_10.src.rpm
i386:
compat-openldap-2.3.43_2.2.29-27.el5_10.i386.rpm
openldap-2.3.43-27.el5_10.i386.rpm
openldap-clients-2.3.43-27.el5_10.i386.rpm
openldap-debuginfo-2.3.43-27.el5_10.i386.rpm
openldap-devel-2.3.43-27.el5_10.i386.rpm
openldap-servers-2.3.43-27.el5_10.i386.rpm
openldap-servers-overlays-2.3.43-27.el5_10.i386.rpm
openldap-servers-sql-2.3.43-27.el5_10.i386.rpm
ia64:
compat-openldap-2.3.43_2.2.29-27.el5_10.i386.rpm
compat-openldap-2.3.43_2.2.29-27.el5_10.ia64.rpm
openldap-2.3.43-27.el5_10.i386.rpm
openldap-2.3.43-27.el5_10.ia64.rpm
openldap-clients-2.3.43-27.el5_10.ia64.rpm
openldap-debuginfo-2.3.43-27.el5_10.i386.rpm
openldap-debuginfo-2.3.43-27.el5_10.ia64.rpm
openldap-devel-2.3.43-27.el5_10.ia64.rpm
openldap-servers-2.3.43-27.el5_10.ia64.rpm
openldap-servers-overlays-2.3.43-27.el5_10.ia64.rpm
openldap-servers-sql-2.3.43-27.el5_10.ia64.rpm
ppc:
compat-openldap-2.3.43_2.2.29-27.el5_10.ppc.rpm
compat-openldap-2.3.43_2.2.29-27.el5_10.ppc64.rpm
openldap-2.3.43-27.el5_10.ppc.rpm
openldap-2.3.43-27.el5_10.ppc64.rpm
openldap-clients-2.3.43-27.el5_10.ppc.rpm
openldap-debuginfo-2.3.43-27.el5_10.ppc.rpm
openldap-debuginfo-2.3.43-27.el5_10.ppc64.rpm
openldap-devel-2.3.43-27.el5_10.ppc.rpm
openldap-devel-2.3.43-27.el5_10.ppc64.rpm
openldap-servers-2.3.43-27.el5_10.ppc.rpm
openldap-servers-overlays-2.3.43-27.el5_10.ppc.rpm
openldap-servers-sql-2.3.43-27.el5_10.ppc.rpm
s390x:
compat-openldap-2.3.43_2.2.29-27.el5_10.s390.rpm
compat-openldap-2.3.43_2.2.29-27.el5_10.s390x.rpm
openldap-2.3.43-27.el5_10.s390.rpm
openldap-2.3.43-27.el5_10.s390x.rpm
openldap-clients-2.3.43-27.el5_10.s390x.rpm
openldap-debuginfo-2.3.43-27.el5_10.s390.rpm
openldap-debuginfo-2.3.43-27.el5_10.s390x.rpm
openldap-devel-2.3.43-27.el5_10.s390.rpm
openldap-devel-2.3.43-27.el5_10.s390x.rpm
openldap-servers-2.3.43-27.el5_10.s390x.rpm
openldap-servers-overlays-2.3.43-27.el5_10.s390x.rpm
openldap-servers-sql-2.3.43-27.el5_10.s390x.rpm
x86_64:
compat-openldap-2.3.43_2.2.29-27.el5_10.i386.rpm
compat-openldap-2.3.43_2.2.29-27.el5_10.x86_64.rpm
openldap-2.3.43-27.el5_10.i386.rpm
openldap-2.3.43-27.el5_10.x86_64.rpm
openldap-clients-2.3.43-27.el5_10.x86_64.rpm
openldap-debuginfo-2.3.43-27.el5_10.i386.rpm
openldap-debuginfo-2.3.43-27.el5_10.x86_64.rpm
openldap-devel-2.3.43-27.el5_10.i386.rpm
openldap-devel-2.3.43-27.el5_10.x86_64.rpm
openldap-servers-2.3.43-27.el5_10.x86_64.rpm
openldap-servers-overlays-2.3.43-27.el5_10.x86_64.rpm
openldap-servers-sql-2.3.43-27.el5_10.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package
7. References:
https://www.redhat.com/security/data/cve/CVE-2013-4449.html
https://access.redhat.com/security/updates/classification/#moderate
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2014 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)
iD8DBQFTC61LXlSAg2UNWIIRAvGMAKClCf/4o8bG6hMFheLHl2ILSlrZGgCfUHX4
vmUDf9PvZMJhQ5Mf8UEw9nI=
=D8pm
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBUwvgdhLndAQH1ShLAQJtjBAAkXQjiCHDcSjjQUbXmapHcGrpWFDsJ6Im
u7R/T6nX0nDLKiupp2HbeGNcT31yMoEvymfebpJgg1TK/V1dO/9t2Ei2LgWIT2J/
H8QDwortEmmBEnP4fAoBHdYRAa1mHW5NHdYgKcN6Kq++T/5PXFNjrQbRRdqr07+i
gEdS18mLOzJNP+1YZid1JQx+jdvDxU8gCE1Mx0QhC/iZmMOUOy4s5aRI/wCclSk0
7TDyTv1tAqYp7lCRVJSYrUl5EihwuywDGl2/3OFG3kYhMvUkfUSBOLzwwVfeeYB1
pqNzlPh2BbGlrdJytvvxSqJ3/n2i43wMwYWs6nMSDQV7lx2St+5ttUZLbDbnvoC6
lZcl4o0+NbAdj8VjY9YIk4oTHha913zi7Cm5h8qubSAmgoz4MLY8NQh5PDMRZgw3
VQwcCIsIEu+PcGKcrFkBDxgsq7P/eDOCV7ksMqGhEcrSDL4adAdQtJOSRLk91DWG
ijp0DmtJek4Cs5e6O48pyN4sqNcVH5wPx8HpqmM166fVFmaz16scemltz0EmP2r7
7fuXvkA8/egxeihmfzqdVPjfPc8Fm1bvZc6tN590kyJCHceumgeyN8BUIZQj74pM
QFZviDKtVIFIyjKdWoN354DVah01D05jBne7YASMx/SFlTSXOR0HBjUIrJdUoLC6
Kcde9J+45mI=
=0lBV
-----END PGP SIGNATURE-----