SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker
bugs
@
securitytracker.com






Category:   Application (Directory)  >   Red Hat Directory Server Vendors:   Red Hat
Red Hat Directory Server Buffer Overflow in Processing Accept-Language HTTP Header Values Lets Remote Users Execute Arbitrary Code
SecurityTracker Alert ID:  1020771
SecurityTracker URL:  http://securitytracker.com/id/1020771
CVE Reference:   CVE-2008-2928   (Links to External Site)
Date:  Aug 27 2008
Impact:   Execution of arbitrary code via network, Root access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 7.1
Description:   A vulnerability was reported in Red Hat Directory Server. A remote user can execute arbitrary code on the target system.

A remote user can send specially crafted data to trigger a buffer overflow in the parsing of Accept-Language HTTP header values and execute arbitrary code on the target system. The code will run with the privileges of the target service (i.e., root privileges).

Impact:   A remote user can execute arbitrary code on the target system.
Solution:   The vendor has issued a fix (7.1 SP7).

The vendor's advisory is available at:

https://rhn.redhat.com/errata/RHSA-2008-0596.html

Vendor URL:  rhn.redhat.com/errata/RHSA-2008-0596.html (Links to External Site)
Cause:   Boundary error
Underlying OS:   Linux (Red Hat Enterprise)

Message History:   This archive entry has one or more follow-up message(s) listed below.
Sep 2 2008 (HP Issues Fix for HP-UX) Red Hat Directory Server Buffer Overflow in Processing Accept-Language HTTP Header Values Lets Remote Users Execute Arbitrary Code
HP has issued a fix for HP-UX 11.11, 11.23, and 11.31.



 Source Message Contents

Date:  Wed, 27 Aug 2008 17:13:20 -0400
Subject:  [RHSA-2008:0596-01] Critical: Red Hat Directory Server 7.1 Service

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Critical: Red Hat Directory Server 7.1 Service Pack 7 security update
Advisory ID:       RHSA-2008:0596-01
Product:           Red Hat Directory Server
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2008-0596.html
Issue date:        2008-08-27
CVE Names:         CVE-2008-2928 CVE-2008-2929 CVE-2008-2930 
                   CVE-2008-3283 
=====================================================================

1. Summary:

An updated redhat-ds package that fixes various security issues is now
available as Red Hat Directory Server 7.1, Service Pack 7.

This update has been rated as having critical security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Directory Server 7.1 (for AS v. 3) - i386
RHEL 3 Directory Server ES - i386
RHEL 4 Directory Server AS - i386
RHEL 4 Directory Server ES - i386

3. Description:

Red Hat Directory Server is an LDAPv3-compliant directory server.

Multiple CGI applications distributed with Red Hat Directory Server were
affected by a buffer overflow flaw in the routine used to parse
Accept-Language HTTP headers. A remote attacker with access to the
Administration Server web interface could use this flaw to crash these CGI
applications or, potentially, execute arbitrary code with the privileges of
the Administration Server. Note: Red Hat Directory Server 7.1 runs the
Administration Server as the root user. (CVE-2008-2928)

Multiple cross-site scripting flaws were discovered in the Directory Server
Administration Express and Directory Server Gateway (DSGW) web interface,
caused by an incorrect parsing of "%" character-escaped user-provided
values. A remote attacker could use these flaws to conduct cross-site
scripting attacks against Directory Server users or administrators using
these web services. (CVE-2008-2929)

Multiple memory leaks were identified in the Directory Server. An
unauthenticated remote attacker could use these flaws to trigger high
memory consumption in the Directory Server, possibly causing it to crash or
terminate unexpectedly when running out of available memory. (CVE-2008-3283)

Ulf Weltman of Hewlett Packard discovered a flaw in the way Directory
Server handled LDAP search requests with patterns. A remote attacker with
access to the LDAP service could create a search request that, when the
search pattern was matched against specially crafted data records, caused
Directory Server to use a large amount of CPU time. Directory Server did
not impose time limits on such search requests. In this updated package,
Directory Server imposes a configurable limit on the pattern-search query
run time, with the default limit set to 30 seconds. (CVE-2008-2930)

In addition to these security fixes, the following bugs have been fixed in
Red Hat Directory Server 7.1, Service Pack 7:

* A modified accountUnlockTime attribute caused by multiple single-user
login failures caused replication to fail, requiring administrator
intervention. Red Hat Directory Server 7.1 Service Pack 7 solves the
replication failure issue in these situations.

* The change sequence numbers in multi-master replication had a built-in
time skew to accommodate differences in the clocks on master servers. Under
certain circumstances, this skew exceeded the maximum allowable skew,
causing replication to stop entirely. In Service Pack 7, this has been fixed.

* In replication scenarios, if an attribute value was scheduled to be
deleted and also was indexed or had an attribute subtype which was indexed,
the Directory Server would crash during the index operation.

* The stack memory size limit used on 64-bit systems was limited to 256KB.
Directory Server could use all the stack memory while performing regular
operations, resulting in slapd daemon crash. 

For more information about Service Pack 7, including upgrade and
installation instructions for users running Red Hat Directory Server 7.1 on
Solaris, refer to the Red Hat Directory Server 7.1 SP7 release notes, which
are linked to in the "References" section of this erratum.

All users of Red Hat Directory Server 7.1 should upgrade to Service Pack 7,
which resolves these issues. 

4. Solution:

This update is available via Red Hat Network.

Users running Red Hat Directory Server 7.1 on Red Hat Enterprise Linux
should consult the following Knowledge Base article for instruction on how
to install updated RPM packages: 

http://kbase.redhat.com/faq/FAQ_58_10188

Users running Red Hat Directory Server 7.1 on Solaris should consult the
Service Pack 7 release notes for installation and upgrade instructions.
These release notes are linked to in the "References" section of this erratum.

5. Bugs fixed (http://bugzilla.redhat.com/):

453916 - CVE-2008-2928 Directory Server: CGI accept language buffer overflow
454065 - CVE-2008-2930 Directory Server: temporary DoS via crafted pattern searches
454621 - CVE-2008-2929 Directory Server: multiple XSS issues
458977 - CVE-2008-3283 Directory Server: multiple memory leaks

6. Package List:

Red Hat Directory Server 7.1 (for AS v. 3):

i386:
redhat-ds-7.1SP7-14.RHEL3.i386.rpm

RHEL 3 Directory Server ES:

i386:
redhat-ds-7.1SP7-14.RHEL3.i386.rpm

RHEL 4 Directory Server AS:

i386:
redhat-ds-7.1SP7-14.RHEL4.i386.rpm

RHEL 4 Directory Server ES:

i386:
redhat-ds-7.1SP7-14.RHEL4.i386.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2928
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2929
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2930
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3283
http://www.redhat.com/security/updates/classification/#critical
http://www.redhat.com/docs/manuals/dir-server/release-notes/7.1SP7/index.html

8. Contact:

The Red Hat security contact is <secalert@redhat.com>.  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2008 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFItcNdXlSAg2UNWIIRAqBlAJ0YGWi7lvYS4BmKImnx0ux/KtWLkgCgsQ53
/B4CkWecabo7XZu0Pz0ybow=
=gdu9
-----END PGP SIGNATURE-----


--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

Copyright 2014, SecurityGlobal.net LLC