Red Hat Directory Server Buffer Overflow in Processing Accept-Language HTTP Header Values Lets Remote Users Execute Arbitrary Code
SecurityTracker Alert ID: 1020771|
SecurityTracker URL: http://securitytracker.com/id/1020771
(Links to External Site)
Date: Aug 27 2008
Execution of arbitrary code via network, Root access via network|
Fix Available: Yes Vendor Confirmed: Yes |
A vulnerability was reported in Red Hat Directory Server. A remote user can execute arbitrary code on the target system.|
A remote user can send specially crafted data to trigger a buffer overflow in the parsing of Accept-Language HTTP header values and execute arbitrary code on the target system. The code will run with the privileges of the target service (i.e., root privileges).
A remote user can execute arbitrary code on the target system.|
The vendor has issued a fix (7.1 SP7).|
The vendor's advisory is available at:
Vendor URL: rhn.redhat.com/errata/RHSA-2008-0596.html (Links to External Site)
|Underlying OS: Linux (Red Hat Enterprise)|
|Underlying OS Comments: 3, 4|
This archive entry has one or more follow-up message(s) listed below.|
Source Message Contents
Subject: [RHSA-2008:0596-01] Critical: Red Hat Directory Server 7.1 Service|
-----BEGIN PGP SIGNED MESSAGE-----
Red Hat Security Advisory
Synopsis: Critical: Red Hat Directory Server 7.1 Service Pack 7 security update
Advisory ID: RHSA-2008:0596-01
Product: Red Hat Directory Server
Advisory URL: https://rhn.redhat.com/errata/RHSA-2008-0596.html
Issue date: 2008-08-27
CVE Names: CVE-2008-2928 CVE-2008-2929 CVE-2008-2930
An updated redhat-ds package that fixes various security issues is now
available as Red Hat Directory Server 7.1, Service Pack 7.
This update has been rated as having critical security impact by the Red
Hat Security Response Team.
2. Relevant releases/architectures:
Red Hat Directory Server 7.1 (for AS v. 3) - i386
RHEL 3 Directory Server ES - i386
RHEL 4 Directory Server AS - i386
RHEL 4 Directory Server ES - i386
Red Hat Directory Server is an LDAPv3-compliant directory server.
Multiple CGI applications distributed with Red Hat Directory Server were
affected by a buffer overflow flaw in the routine used to parse
Accept-Language HTTP headers. A remote attacker with access to the
Administration Server web interface could use this flaw to crash these CGI
applications or, potentially, execute arbitrary code with the privileges of
the Administration Server. Note: Red Hat Directory Server 7.1 runs the
Administration Server as the root user. (CVE-2008-2928)
Multiple cross-site scripting flaws were discovered in the Directory Server
Administration Express and Directory Server Gateway (DSGW) web interface,
caused by an incorrect parsing of "%" character-escaped user-provided
values. A remote attacker could use these flaws to conduct cross-site
scripting attacks against Directory Server users or administrators using
these web services. (CVE-2008-2929)
Multiple memory leaks were identified in the Directory Server. An
unauthenticated remote attacker could use these flaws to trigger high
memory consumption in the Directory Server, possibly causing it to crash or
terminate unexpectedly when running out of available memory. (CVE-2008-3283)
Ulf Weltman of Hewlett Packard discovered a flaw in the way Directory
Server handled LDAP search requests with patterns. A remote attacker with
access to the LDAP service could create a search request that, when the
search pattern was matched against specially crafted data records, caused
Directory Server to use a large amount of CPU time. Directory Server did
not impose time limits on such search requests. In this updated package,
Directory Server imposes a configurable limit on the pattern-search query
run time, with the default limit set to 30 seconds. (CVE-2008-2930)
In addition to these security fixes, the following bugs have been fixed in
Red Hat Directory Server 7.1, Service Pack 7:
* A modified accountUnlockTime attribute caused by multiple single-user
login failures caused replication to fail, requiring administrator
intervention. Red Hat Directory Server 7.1 Service Pack 7 solves the
replication failure issue in these situations.
* The change sequence numbers in multi-master replication had a built-in
time skew to accommodate differences in the clocks on master servers. Under
certain circumstances, this skew exceeded the maximum allowable skew,
causing replication to stop entirely. In Service Pack 7, this has been fixed.
* In replication scenarios, if an attribute value was scheduled to be
deleted and also was indexed or had an attribute subtype which was indexed,
the Directory Server would crash during the index operation.
* The stack memory size limit used on 64-bit systems was limited to 256KB.
Directory Server could use all the stack memory while performing regular
operations, resulting in slapd daemon crash.
For more information about Service Pack 7, including upgrade and
installation instructions for users running Red Hat Directory Server 7.1 on
Solaris, refer to the Red Hat Directory Server 7.1 SP7 release notes, which
are linked to in the "References" section of this erratum.
All users of Red Hat Directory Server 7.1 should upgrade to Service Pack 7,
which resolves these issues.
This update is available via Red Hat Network.
Users running Red Hat Directory Server 7.1 on Red Hat Enterprise Linux
should consult the following Knowledge Base article for instruction on how
to install updated RPM packages:
Users running Red Hat Directory Server 7.1 on Solaris should consult the
Service Pack 7 release notes for installation and upgrade instructions.
These release notes are linked to in the "References" section of this erratum.
5. Bugs fixed (http://bugzilla.redhat.com/):
453916 - CVE-2008-2928 Directory Server: CGI accept language buffer overflow
454065 - CVE-2008-2930 Directory Server: temporary DoS via crafted pattern searches
454621 - CVE-2008-2929 Directory Server: multiple XSS issues
458977 - CVE-2008-3283 Directory Server: multiple memory leaks
6. Package List:
Red Hat Directory Server 7.1 (for AS v. 3):
RHEL 3 Directory Server ES:
RHEL 4 Directory Server AS:
RHEL 4 Directory Server ES:
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
The Red Hat security contact is <email@example.com>. More contact
details at https://www.redhat.com/security/team/contact/
Copyright 2008 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)
-----END PGP SIGNATURE-----
RHSA-announce mailing list