[ MDVSA-2008:058 ] - Updated openldap packages fix multiple vulnerabilities




-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2008:058
http://www.mandriva.com/security/
_______________________________________________________________________

Package : openldap
Date : March 5, 2008
Affected: 2007.0, 2007.1, 2008.0, Corporate 4.0
_______________________________________________________________________

Problem Description:

A vulnerability was found in slapo-pcache in slapd of OpenLDAP prior
to 2.3.39 when running as a proxy-caching server. It would allocate
memory using a malloc variant rather than calloc, which prevented
an array from being properly initialized and could possibly allow
attackers to cause a denial of service (CVE-2007-5708).

Two vulnerabilities were found in how slapd handled modify (prior
to 2.3.26) and modrdn (prior to 2.3.29) requests with NOOP control
on objects stored in the BDB backend. An authenticated user with
permission to perform modify (CVE-2007-6698) or modrdn (CVE-2008-0658)
operations could cause slapd to crash.

The updated packages have been patched to correct these issues.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5708
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6698
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0658
_______________________________________________________________________

Updated Packages:

Mandriva Linux 2007.0:
d4427f6f960dceb0a54887395688b02d 2007.0/i586/libldap2.3_0-2.3.27-2.2mdv2007.0.i586.rpm
fb96499f3a33a20274b95ae1fe986938 2007.0/i586/libldap2.3_0-devel-2.3.27-2.2mdv2007.0.i586.rpm
0fe0f9a22d5a3d2b8d07170f7e02c360 2007.0/i586/libldap2.3_0-static-devel-2.3.27-2.2mdv2007.0.i586.rpm
248f3a65f570e22b7d1ec67e95a0249e 2007.0/i586/openldap-2.3.27-2.2mdv2007.0.i586.rpm
0ecb5d940de1ec31b1191110d3b40e4e 2007.0/i586/openldap-clients-2.3.27-2.2mdv2007.0.i586.rpm
43170f54bac53b30c6129b07253ab7f6 2007.0/i586/openldap-doc-2.3.27-2.2mdv2007.0.i586.rpm
16a103849faddc8b9e300bd7738b5bde 2007.0/i586/openldap-servers-2.3.27-2.2mdv2007.0.i586.rpm
53476478b042cbbbb2e59edf5a2ff330 2007.0/SRPMS/openldap-2.3.27-2.2mdv2007.0.src.rpm

Mandriva Linux 2007.0/X86_64:
eb36e1526f2b3a3a03271edf66d2cca4 2007.0/x86_64/lib64ldap2.3_0-2.3.27-2.2mdv2007.0.x86_64.rpm
6b37c2ee41eb94cb65ec40d551538022 2007.0/x86_64/lib64ldap2.3_0-devel-2.3.27-2.2mdv2007.0.x86_64.rpm
6f009e31ac35621ffa9247501d583ed1 2007.0/x86_64/lib64ldap2.3_0-static-devel-2.3.27-2.2mdv2007.0.x86_64.rpm
445fb7aeb7818f0358659c91fb8ada70 2007.0/x86_64/openldap-2.3.27-2.2mdv2007.0.x86_64.rpm
3cc4725e66a377e07e908f48ee149acb 2007.0/x86_64/openldap-clients-2.3.27-2.2mdv2007.0.x86_64.rpm
c5ba86642d7c9e6f3fe51d1201f9596c 2007.0/x86_64/openldap-doc-2.3.27-2.2mdv2007.0.x86_64.rpm
13f4514be8c8f989cc4a1537ec8f8177 2007.0/x86_64/openldap-servers-2.3.27-2.2mdv2007.0.x86_64.rpm
53476478b042cbbbb2e59edf5a2ff330 2007.0/SRPMS/openldap-2.3.27-2.2mdv2007.0.src.rpm

Mandriva Linux 2007.1:
7cc3081ddcfd3db452d2e90036e3a628 2007.1/i586/libldap2.3_0-2.3.34-5.2mdv2007.1.i586.rpm
fbc6f5333b7ca7796d95e8a3718f164a 2007.1/i586/libldap2.3_0-devel-2.3.34-5.2mdv2007.1.i586.rpm
e7d258fa40a2a5c52314c856b3bc4fc1 2007.1/i586/libldap2.3_0-static-devel-2.3.34-5.2mdv2007.1.i586.rpm
589ef40a1af243f7664965fe090f7de2 2007.1/i586/openldap-2.3.34-5.2mdv2007.1.i586.rpm
ce64d22f74a555746a408d86ab5c24cb 2007.1/i586/openldap-clients-2.3.34-5.2mdv2007.1.i586.rpm
35e5939274493799d93f2eca1388420a 2007.1/i586/openldap-doc-2.3.34-5.2mdv2007.1.i586.rpm
4dd84314508659366aaf95027f37896d 2007.1/i586/openldap-servers-2.3.34-5.2mdv2007.1.i586.rpm
1117b03409884c7799a1f7fd4ac29725 2007.1/i586/openldap-testprogs-2.3.34-5.2mdv2007.1.i586.rpm
67f80a1770d45f7e7e294bd8ec92846e 2007.1/i586/openldap-tests-2.3.34-5.2mdv2007.1.i586.rpm
a686ce5b015b7accd63d327a0f898d84 2007.1/SRPMS/openldap-2.3.34-5.2mdv2007.1.src.rpm

Mandriva Linux 2007.1/X86_64:
d47695976ba1bb63169509da41e57e07 2007.1/x86_64/lib64ldap2.3_0-2.3.34-5.2mdv2007.1.x86_64.rpm
e6223017fb3b35792e680db1203aca6c 2007.1/x86_64/lib64ldap2.3_0-devel-2.3.34-5.2mdv2007.1.x86_64.rpm
320f8173708590828f70b4995d8ef2a8 2007.1/x86_64/lib64ldap2.3_0-static-devel-2.3.34-5.2mdv2007.1.x86_64.rpm
3b008b7ed26ea10234a13289e84f9388 2007.1/x86_64/openldap-2.3.34-5.2mdv2007.1.x86_64.rpm
c158c817b74e2c1e678e8d34fef24a0e 2007.1/x86_64/openldap-clients-2.3.34-5.2mdv2007.1.x86_64.rpm
7b457f83f95361b82e3340cdbc5dcff1 2007.1/x86_64/openldap-doc-2.3.34-5.2mdv2007.1.x86_64.rpm
fde2e695d34441ae77714de0fb42d1ba 2007.1/x86_64/openldap-servers-2.3.34-5.2mdv2007.1.x86_64.rpm
96715702c27b99497c5ec7aa917fb586 2007.1/x86_64/openldap-testprogs-2.3.34-5.2mdv2007.1.x86_64.rpm
f55189544f96a7de67af997eae52631b 2007.1/x86_64/openldap-tests-2.3.34-5.2mdv2007.1.x86_64.rpm
a686ce5b015b7accd63d327a0f898d84 2007.1/SRPMS/openldap-2.3.34-5.2mdv2007.1.src.rpm

Mandriva Linux 2008.0:
50d197a5004773e80a4fa3fbf64f683b 2008.0/i586/libldap2.3_0-2.3.38-3.2mdv2008.0.i586.rpm
3fb1cbd91ce0b520f1185883ba6631e4 2008.0/i586/libldap2.3_0-devel-2.3.38-3.2mdv2008.0.i586.rpm
e6afb970700d63e982fb62108a5483af 2008.0/i586/libldap2.3_0-static-devel-2.3.38-3.2mdv2008.0.i586.rpm
bbdc4dc9929c911d63638833b636da11 2008.0/i586/openldap-2.3.38-3.2mdv2008.0.i586.rpm
21ba24d4b6f8b09f7870e94c983e5706 2008.0/i586/openldap-clients-2.3.38-3.2mdv2008.0.i586.rpm
8b12e3e7f72ca68c7839a4deccbd8781 2008.0/i586/openldap-doc-2.3.38-3.2mdv2008.0.i586.rpm
04abf0a21b507a3626667f4bc7755738 2008.0/i586/openldap-servers-2.3.38-3.2mdv2008.0.i586.rpm
fd6652cb4645b22b77afaa5e7d46c5b8 2008.0/i586/openldap-testprogs-2.3.38-3.2mdv2008.0.i586.rpm
14690bfcbf5c3cbaf9f34e86fe812d58 2008.0/i586/openldap-tests-2.3.38-3.2mdv2008.0.i586.rpm
d04ebbb872eecb60934dbda7ad8cc310 2008.0/SRPMS/openldap-2.3.38-3.2mdv2008.0.src.rpm

Mandriva Linux 2008.0/X86_64:
e743f1c46812c62178d82792e78580b3 2008.0/x86_64/lib64ldap2.3_0-2.3.38-3.2mdv2008.0.x86_64.rpm
02a8a95838044337c7c2813b2b6158cb 2008.0/x86_64/lib64ldap2.3_0-devel-2.3.38-3.2mdv2008.0.x86_64.rpm
4497a989916bda44db6bd5ce93373907 2008.0/x86_64/lib64ldap2.3_0-static-devel-2.3.38-3.2mdv2008.0.x86_64.rpm
a0c92471258de04a589a651bd571ece6 2008.0/x86_64/openldap-2.3.38-3.2mdv2008.0.x86_64.rpm
16268ccf7f5fbc375c4fd8313bd389de 2008.0/x86_64/openldap-clients-2.3.38-3.2mdv2008.0.x86_64.rpm
72de58e66a16f68212bff5fb899cf44c 2008.0/x86_64/openldap-doc-2.3.38-3.2mdv2008.0.x86_64.rpm
7510f04c21750fca734ad4bd9c0b336e 2008.0/x86_64/openldap-servers-2.3.38-3.2mdv2008.0.x86_64.rpm
353a580e2280b765e99906cd598f641a 2008.0/x86_64/openldap-testprogs-2.3.38-3.2mdv2008.0.x86_64.rpm
1170527a0621b41bb9257bb3e1922dc1 2008.0/x86_64/openldap-tests-2.3.38-3.2mdv2008.0.x86_64.rpm
d04ebbb872eecb60934dbda7ad8cc310 2008.0/SRPMS/openldap-2.3.38-3.2mdv2008.0.src.rpm

Corporate 4.0:
4f14a96268be28e1a5b486e153080ff8 corporate/4.0/i586/libldap2.3_0-2.3.27-1.4.20060mlcs4.i586.rpm
00a834b2fa4941e2c1a4a58c6c034df6 corporate/4.0/i586/libldap2.3_0-devel-2.3.27-1.4.20060mlcs4.i586.rpm
b21351bf410ad80dd2165cd680ec5512 corporate/4.0/i586/libldap2.3_0-static-devel-2.3.27-1.4.20060mlcs4.i586.rpm
f76ddc4f7daef7163d2b6ae3dc159bfa corporate/4.0/i586/openldap-2.3.27-1.4.20060mlcs4.i586.rpm
4f39a60ebc0f10b448249a6fd391881a corporate/4.0/i586/openldap-clients-2.3.27-1.4.20060mlcs4.i586.rpm
56c6a71605ef78d91f39764a6bd5805c corporate/4.0/i586/openldap-doc-2.3.27-1.4.20060mlcs4.i586.rpm
278c5076219f41b620fe4be209b560f6 corporate/4.0/i586/openldap-servers-2.3.27-1.4.20060mlcs4.i586.rpm
2ae4d3fde1ca0cdc2718edba0ed5caa7 corporate/4.0/SRPMS/openldap-2.3.27-1.4.20060mlcs4.src.rpm

Corporate 4.0/X86_64:
001e7ac83e8b0f4bd786c7a34b18bc6f corporate/4.0/x86_64/lib64ldap2.3_0-2.3.27-1.4.20060mlcs4.x86_64.rpm
3a383bce15adeb349f2cbc2e2e09e617 corporate/4.0/x86_64/lib64ldap2.3_0-devel-2.3.27-1.4.20060mlcs4.x86_64.rpm
fb829cc7b376913774f7e17f63126ea7 corporate/4.0/x86_64/lib64ldap2.3_0-static-devel-2.3.27-1.4.20060mlcs4.x86_64.rpm
8cf4600913c6f0480dcb4a83a2caf97e corporate/4.0/x86_64/openldap-2.3.27-1.4.20060mlcs4.x86_64.rpm
ebee2e465a241aef5a6317dff68cf939 corporate/4.0/x86_64/openldap-clients-2.3.27-1.4.20060mlcs4.x86_64.rpm
b27b946152945b36385ed80cfaca5960 corporate/4.0/x86_64/openldap-doc-2.3.27-1.4.20060mlcs4.x86_64.rpm
e567e790d1ae957531f899cb6fc766cf corporate/4.0/x86_64/openldap-servers-2.3.27-1.4.20060mlcs4.x86_64.rpm
2ae4d3fde1ca0cdc2718edba0ed5caa7 corporate/4.0/SRPMS/openldap-2.3.27-1.4.20060mlcs4.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (GNU/Linux)

iD4DBQFHzsnrmqjQ0CJFipgRAjZAAKCvb4GW3/uY7uLIBuTkI5eqiVzkOACY0HKn
tOFiQm6cMHQ8KwyDVlpFDA==
=lnDg
-----END PGP SIGNATURE-----



Relevant Pages

  • [Full-disclosure] [ MDVSA-2008:058 ] - Updated openldap packages fix multiple vulnerabil
    ... A vulnerability was found in slapo-pcache in slapd of OpenLDAP prior ... The updated packages have been patched to correct these issues. ... Mandriva Linux 2007.0/X86_64: ...
    (Full-Disclosure)
  • [Full-disclosure] [ MDVSA-2008:163 ] python
    ... Multiple integer overflows in the imageop module in Python prior to ... Multiple integer overflows were reported by the Google Security Team ... The updated packages have been patched to correct these issues. ... Python packages on Mandriva Linux 2007.1 and 2008.0 have ...
    (Full-Disclosure)
  • [ MDVSA-2008:163 ] python
    ... Multiple integer overflows in the imageop module in Python prior to ... Multiple integer overflows were reported by the Google Security Team ... The updated packages have been patched to correct these issues. ... Python packages on Mandriva Linux 2007.1 and 2008.0 have ...
    (Bugtraq)
  • [Full-disclosure] [ MDVSA-2011:079 ] firefox
    ... Chris Evans of the Chrome Security Team reported that the XSLT ... Packages for 2009.0 are provided as of the Extended Maintenance ... Mandriva Linux 2009.0/X86_64: ... If you want to report vulnerabilities, ...
    (Full-Disclosure)
  • [ MDVSA-2011:079 ] firefox
    ... Chris Evans of the Chrome Security Team reported that the XSLT ... Packages for 2009.0 are provided as of the Extended Maintenance ... Mandriva Linux 2009.0/X86_64: ... If you want to report vulnerabilities, ...
    (Bugtraq)