[ MDVSA-2008:058 ] - Updated openldap packages fix multiple vulnerabilities
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2008:058
http://www.mandriva.com/security/
_______________________________________________________________________
Package : openldap
Date : March 5, 2008
Affected: 2007.0, 2007.1, 2008.0, Corporate 4.0
_______________________________________________________________________
Problem Description:
A vulnerability was found in slapo-pcache in slapd of OpenLDAP prior
to 2.3.39 when running as a proxy-caching server. It would allocate
memory using a malloc variant rather than calloc, which prevented
an array from being properly initialized and could possibly allow
attackers to cause a denial of service (CVE-2007-5708).
Two vulnerabilities were found in how slapd handled modify (prior
to 2.3.26) and modrdn (prior to 2.3.29) requests with NOOP control
on objects stored in the BDB backend. An authenticated user with
permission to perform modify (CVE-2007-6698) or modrdn (CVE-2008-0658)
operations could cause slapd to crash.
The updated packages have been patched to correct these issues.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5708
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6698
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0658
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2007.0:
d4427f6f960dceb0a54887395688b02d
2007.0/i586/libldap2.3_0-2.3.27-2.2mdv2007.0.i586.rpm
fb96499f3a33a20274b95ae1fe986938
2007.0/i586/libldap2.3_0-devel-2.3.27-2.2mdv2007.0.i586.rpm
0fe0f9a22d5a3d2b8d07170f7e02c360
2007.0/i586/libldap2.3_0-static-devel-2.3.27-2.2mdv2007.0.i586.rpm
248f3a65f570e22b7d1ec67e95a0249e
2007.0/i586/openldap-2.3.27-2.2mdv2007.0.i586.rpm
0ecb5d940de1ec31b1191110d3b40e4e
2007.0/i586/openldap-clients-2.3.27-2.2mdv2007.0.i586.rpm
43170f54bac53b30c6129b07253ab7f6
2007.0/i586/openldap-doc-2.3.27-2.2mdv2007.0.i586.rpm
16a103849faddc8b9e300bd7738b5bde
2007.0/i586/openldap-servers-2.3.27-2.2mdv2007.0.i586.rpm
53476478b042cbbbb2e59edf5a2ff330
2007.0/SRPMS/openldap-2.3.27-2.2mdv2007.0.src.rpm
Mandriva Linux 2007.0/X86_64:
eb36e1526f2b3a3a03271edf66d2cca4
2007.0/x86_64/lib64ldap2.3_0-2.3.27-2.2mdv2007.0.x86_64.rpm
6b37c2ee41eb94cb65ec40d551538022
2007.0/x86_64/lib64ldap2.3_0-devel-2.3.27-2.2mdv2007.0.x86_64.rpm
6f009e31ac35621ffa9247501d583ed1
2007.0/x86_64/lib64ldap2.3_0-static-devel-2.3.27-2.2mdv2007.0.x86_64.rpm
445fb7aeb7818f0358659c91fb8ada70
2007.0/x86_64/openldap-2.3.27-2.2mdv2007.0.x86_64.rpm
3cc4725e66a377e07e908f48ee149acb
2007.0/x86_64/openldap-clients-2.3.27-2.2mdv2007.0.x86_64.rpm
c5ba86642d7c9e6f3fe51d1201f9596c
2007.0/x86_64/openldap-doc-2.3.27-2.2mdv2007.0.x86_64.rpm
13f4514be8c8f989cc4a1537ec8f8177
2007.0/x86_64/openldap-servers-2.3.27-2.2mdv2007.0.x86_64.rpm
53476478b042cbbbb2e59edf5a2ff330
2007.0/SRPMS/openldap-2.3.27-2.2mdv2007.0.src.rpm
Mandriva Linux 2007.1:
7cc3081ddcfd3db452d2e90036e3a628
2007.1/i586/libldap2.3_0-2.3.34-5.2mdv2007.1.i586.rpm
fbc6f5333b7ca7796d95e8a3718f164a
2007.1/i586/libldap2.3_0-devel-2.3.34-5.2mdv2007.1.i586.rpm
e7d258fa40a2a5c52314c856b3bc4fc1
2007.1/i586/libldap2.3_0-static-devel-2.3.34-5.2mdv2007.1.i586.rpm
589ef40a1af243f7664965fe090f7de2
2007.1/i586/openldap-2.3.34-5.2mdv2007.1.i586.rpm
ce64d22f74a555746a408d86ab5c24cb
2007.1/i586/openldap-clients-2.3.34-5.2mdv2007.1.i586.rpm
35e5939274493799d93f2eca1388420a
2007.1/i586/openldap-doc-2.3.34-5.2mdv2007.1.i586.rpm
4dd84314508659366aaf95027f37896d
2007.1/i586/openldap-servers-2.3.34-5.2mdv2007.1.i586.rpm
1117b03409884c7799a1f7fd4ac29725
2007.1/i586/openldap-testprogs-2.3.34-5.2mdv2007.1.i586.rpm
67f80a1770d45f7e7e294bd8ec92846e
2007.1/i586/openldap-tests-2.3.34-5.2mdv2007.1.i586.rpm
a686ce5b015b7accd63d327a0f898d84
2007.1/SRPMS/openldap-2.3.34-5.2mdv2007.1.src.rpm
Mandriva Linux 2007.1/X86_64:
d47695976ba1bb63169509da41e57e07
2007.1/x86_64/lib64ldap2.3_0-2.3.34-5.2mdv2007.1.x86_64.rpm
e6223017fb3b35792e680db1203aca6c
2007.1/x86_64/lib64ldap2.3_0-devel-2.3.34-5.2mdv2007.1.x86_64.rpm
320f8173708590828f70b4995d8ef2a8
2007.1/x86_64/lib64ldap2.3_0-static-devel-2.3.34-5.2mdv2007.1.x86_64.rpm
3b008b7ed26ea10234a13289e84f9388
2007.1/x86_64/openldap-2.3.34-5.2mdv2007.1.x86_64.rpm
c158c817b74e2c1e678e8d34fef24a0e
2007.1/x86_64/openldap-clients-2.3.34-5.2mdv2007.1.x86_64.rpm
7b457f83f95361b82e3340cdbc5dcff1
2007.1/x86_64/openldap-doc-2.3.34-5.2mdv2007.1.x86_64.rpm
fde2e695d34441ae77714de0fb42d1ba
2007.1/x86_64/openldap-servers-2.3.34-5.2mdv2007.1.x86_64.rpm
96715702c27b99497c5ec7aa917fb586
2007.1/x86_64/openldap-testprogs-2.3.34-5.2mdv2007.1.x86_64.rpm
f55189544f96a7de67af997eae52631b
2007.1/x86_64/openldap-tests-2.3.34-5.2mdv2007.1.x86_64.rpm
a686ce5b015b7accd63d327a0f898d84
2007.1/SRPMS/openldap-2.3.34-5.2mdv2007.1.src.rpm
Mandriva Linux 2008.0:
50d197a5004773e80a4fa3fbf64f683b
2008.0/i586/libldap2.3_0-2.3.38-3.2mdv2008.0.i586.rpm
3fb1cbd91ce0b520f1185883ba6631e4
2008.0/i586/libldap2.3_0-devel-2.3.38-3.2mdv2008.0.i586.rpm
e6afb970700d63e982fb62108a5483af
2008.0/i586/libldap2.3_0-static-devel-2.3.38-3.2mdv2008.0.i586.rpm
bbdc4dc9929c911d63638833b636da11
2008.0/i586/openldap-2.3.38-3.2mdv2008.0.i586.rpm
21ba24d4b6f8b09f7870e94c983e5706
2008.0/i586/openldap-clients-2.3.38-3.2mdv2008.0.i586.rpm
8b12e3e7f72ca68c7839a4deccbd8781
2008.0/i586/openldap-doc-2.3.38-3.2mdv2008.0.i586.rpm
04abf0a21b507a3626667f4bc7755738
2008.0/i586/openldap-servers-2.3.38-3.2mdv2008.0.i586.rpm
fd6652cb4645b22b77afaa5e7d46c5b8
2008.0/i586/openldap-testprogs-2.3.38-3.2mdv2008.0.i586.rpm
14690bfcbf5c3cbaf9f34e86fe812d58
2008.0/i586/openldap-tests-2.3.38-3.2mdv2008.0.i586.rpm
d04ebbb872eecb60934dbda7ad8cc310
2008.0/SRPMS/openldap-2.3.38-3.2mdv2008.0.src.rpm
Mandriva Linux 2008.0/X86_64:
e743f1c46812c62178d82792e78580b3
2008.0/x86_64/lib64ldap2.3_0-2.3.38-3.2mdv2008.0.x86_64.rpm
02a8a95838044337c7c2813b2b6158cb
2008.0/x86_64/lib64ldap2.3_0-devel-2.3.38-3.2mdv2008.0.x86_64.rpm
4497a989916bda44db6bd5ce93373907
2008.0/x86_64/lib64ldap2.3_0-static-devel-2.3.38-3.2mdv2008.0.x86_64.rpm
a0c92471258de04a589a651bd571ece6
2008.0/x86_64/openldap-2.3.38-3.2mdv2008.0.x86_64.rpm
16268ccf7f5fbc375c4fd8313bd389de
2008.0/x86_64/openldap-clients-2.3.38-3.2mdv2008.0.x86_64.rpm
72de58e66a16f68212bff5fb899cf44c
2008.0/x86_64/openldap-doc-2.3.38-3.2mdv2008.0.x86_64.rpm
7510f04c21750fca734ad4bd9c0b336e
2008.0/x86_64/openldap-servers-2.3.38-3.2mdv2008.0.x86_64.rpm
353a580e2280b765e99906cd598f641a
2008.0/x86_64/openldap-testprogs-2.3.38-3.2mdv2008.0.x86_64.rpm
1170527a0621b41bb9257bb3e1922dc1
2008.0/x86_64/openldap-tests-2.3.38-3.2mdv2008.0.x86_64.rpm
d04ebbb872eecb60934dbda7ad8cc310
2008.0/SRPMS/openldap-2.3.38-3.2mdv2008.0.src.rpm
Corporate 4.0:
4f14a96268be28e1a5b486e153080ff8
corporate/4.0/i586/libldap2.3_0-2.3.27-1.4.20060mlcs4.i586.rpm
00a834b2fa4941e2c1a4a58c6c034df6
corporate/4.0/i586/libldap2.3_0-devel-2.3.27-1.4.20060mlcs4.i586.rpm
b21351bf410ad80dd2165cd680ec5512
corporate/4.0/i586/libldap2.3_0-static-devel-2.3.27-1.4.20060mlcs4.i586.rpm
f76ddc4f7daef7163d2b6ae3dc159bfa
corporate/4.0/i586/openldap-2.3.27-1.4.20060mlcs4.i586.rpm
4f39a60ebc0f10b448249a6fd391881a
corporate/4.0/i586/openldap-clients-2.3.27-1.4.20060mlcs4.i586.rpm
56c6a71605ef78d91f39764a6bd5805c
corporate/4.0/i586/openldap-doc-2.3.27-1.4.20060mlcs4.i586.rpm
278c5076219f41b620fe4be209b560f6
corporate/4.0/i586/openldap-servers-2.3.27-1.4.20060mlcs4.i586.rpm
2ae4d3fde1ca0cdc2718edba0ed5caa7
corporate/4.0/SRPMS/openldap-2.3.27-1.4.20060mlcs4.src.rpm
Corporate 4.0/X86_64:
001e7ac83e8b0f4bd786c7a34b18bc6f
corporate/4.0/x86_64/lib64ldap2.3_0-2.3.27-1.4.20060mlcs4.x86_64.rpm
3a383bce15adeb349f2cbc2e2e09e617
corporate/4.0/x86_64/lib64ldap2.3_0-devel-2.3.27-1.4.20060mlcs4.x86_64.rpm
fb829cc7b376913774f7e17f63126ea7
corporate/4.0/x86_64/lib64ldap2.3_0-static-devel-2.3.27-1.4.20060mlcs4.x86_64.rpm
8cf4600913c6f0480dcb4a83a2caf97e
corporate/4.0/x86_64/openldap-2.3.27-1.4.20060mlcs4.x86_64.rpm
ebee2e465a241aef5a6317dff68cf939
corporate/4.0/x86_64/openldap-clients-2.3.27-1.4.20060mlcs4.x86_64.rpm
b27b946152945b36385ed80cfaca5960
corporate/4.0/x86_64/openldap-doc-2.3.27-1.4.20060mlcs4.x86_64.rpm
e567e790d1ae957531f899cb6fc766cf
corporate/4.0/x86_64/openldap-servers-2.3.27-1.4.20060mlcs4.x86_64.rpm
2ae4d3fde1ca0cdc2718edba0ed5caa7
corporate/4.0/SRPMS/openldap-2.3.27-1.4.20060mlcs4.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (GNU/Linux)
iD4DBQFHzsnrmqjQ0CJFipgRAjZAAKCvb4GW3/uY7uLIBuTkI5eqiVzkOACY0HKn
tOFiQm6cMHQ8KwyDVlpFDA==
=lnDg
-----END PGP SIGNATURE-----