[RHSA-2017:0920-01] Important: 389-ds-base security and bug fix update

[news 28]

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1

 

=====================================================================

Red Hat Security Advisory

 

Synopsis: Important: 389-ds-base security and bug fix update

Advisory ID: RHSA-2017:0920-01

Product: Red Hat Enterprise Linux

Advisory URL: https://access.redhat.com/errata/RHSA-2017:0920

Issue date: 2017-04-12

CVE Names: CVE-2017-2668

=====================================================================

 

1. Summary:

 

An update for 389-ds-base is now available for Red Hat Enterprise Linux 7.

 

Red Hat Product Security has rated this update as having a security impact

of Important. A Common Vulnerability Scoring System (CVSS) base score,

which gives a detailed severity rating, is available for each vulnerability

from the CVE link(s) in the References section.

 

2. Relevant releases/architectures:

 

Red Hat Enterprise Linux Client Optional (v. 7) - x86_64

Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64

Red Hat Enterprise Linux Server (v. 7) - aarch64, ppc64le, x86_64

Red Hat Enterprise Linux Server Optional (v. 7) - aarch64, ppc64le, x86_64

Red Hat Enterprise Linux Workstation (v. 7) - x86_64

Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64

 

3. Description:

 

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The

base packages include the Lightweight Directory Access Protocol (LDAP)

server and command-line utilities for server administration.

 

Security Fix(es):

 

* An invalid pointer dereference flaw was found in the way 389-ds-base

handled LDAP bind requests. A remote unauthenticated attacker could use

this flaw to make ns-slapd crash via a specially crafted LDAP bind request,

resulting in denial of service. (CVE-2017-2668)

 

Red Hat would like to thank Joachim Jabs (F24) for reporting this issue.

 

Bug Fix(es):

 

* Previously, when adding a filtered role definition that uses the "nsrole"

virtual attribute in the filter, Directory Server terminated unexpectedly.

A patch has been applied, and now the roles plug-in ignores all virtual

attributes. As a result, an error message is logged when an invalid filter

is used. Additionally, the role is deactivated and Directory Server no

longer fails. (BZ#1429498)

 

* In a replication topology, Directory Server incorrectly calculated the

size of string format entries when a lot of entries were deleted. The

calculated size of entries was smaller than the actual required size.

Consequently, Directory Server allocated insufficient memory and terminated

unexpectedly when the data was written to it. With this update, the size of

string format entries is now calculated correctly in the described

situation and Directory Server no longer terminates unexpectedly.

(BZ#1429495)

 

4. Solution:

 

For details on how to apply this update, which includes the changes

described in this advisory, refer to:

 

https://access.redhat.com/articles/11258

 

After installing this update, the 389 server service will be restarted

automatically.

 

5. Bugs fixed (https://bugzilla.redhat.com/):

 

1429495 - ns-slapd dies under heavy load

1429498 - A filtered nsrole that specifies an empty nsrole in its nsRoleFilter will result in a segfault.

1436575 - CVE-2017-2668 389-ds-base: Remote crash via crafted LDAP messages

 

6. Package List:

 

Red Hat Enterprise Linux Client Optional (v. 7):

 

Source:

389-ds-base-1.3.5.10-20.el7_3.src.rpm

 

x86_64:

389-ds-base-1.3.5.10-20.el7_3.x86_64.rpm

389-ds-base-debuginfo-1.3.5.10-20.el7_3.x86_64.rpm

389-ds-base-devel-1.3.5.10-20.el7_3.x86_64.rpm

389-ds-base-libs-1.3.5.10-20.el7_3.x86_64.rpm

389-ds-base-snmp-1.3.5.10-20.el7_3.x86_64.rpm

 

Red Hat Enterprise Linux ComputeNode Optional (v. 7):

 

Source:

389-ds-base-1.3.5.10-20.el7_3.src.rpm

 

x86_64:

389-ds-base-1.3.5.10-20.el7_3.x86_64.rpm

389-ds-base-debuginfo-1.3.5.10-20.el7_3.x86_64.rpm

389-ds-base-devel-1.3.5.10-20.el7_3.x86_64.rpm

389-ds-base-libs-1.3.5.10-20.el7_3.x86_64.rpm

389-ds-base-snmp-1.3.5.10-20.el7_3.x86_64.rpm

 

Red Hat Enterprise Linux Server (v. 7):

 

Source:

389-ds-base-1.3.5.10-20.el7_3.src.rpm

 

aarch64:

389-ds-base-1.3.5.10-20.el7_3.aarch64.rpm

389-ds-base-debuginfo-1.3.5.10-20.el7_3.aarch64.rpm

389-ds-base-libs-1.3.5.10-20.el7_3.aarch64.rpm

 

ppc64le:

389-ds-base-1.3.5.10-20.el7_3.ppc64le.rpm

389-ds-base-debuginfo-1.3.5.10-20.el7_3.ppc64le.rpm

389-ds-base-libs-1.3.5.10-20.el7_3.ppc64le.rpm

 

x86_64:

389-ds-base-1.3.5.10-20.el7_3.x86_64.rpm

389-ds-base-debuginfo-1.3.5.10-20.el7_3.x86_64.rpm

389-ds-base-libs-1.3.5.10-20.el7_3.x86_64.rpm

 

Red Hat Enterprise Linux Server Optional (v. 7):

 

aarch64:

389-ds-base-debuginfo-1.3.5.10-20.el7_3.aarch64.rpm

389-ds-base-devel-1.3.5.10-20.el7_3.aarch64.rpm

389-ds-base-snmp-1.3.5.10-20.el7_3.aarch64.rpm

 

ppc64le:

389-ds-base-debuginfo-1.3.5.10-20.el7_3.ppc64le.rpm

389-ds-base-devel-1.3.5.10-20.el7_3.ppc64le.rpm

389-ds-base-snmp-1.3.5.10-20.el7_3.ppc64le.rpm

 

x86_64:

389-ds-base-debuginfo-1.3.5.10-20.el7_3.x86_64.rpm

389-ds-base-devel-1.3.5.10-20.el7_3.x86_64.rpm

389-ds-base-snmp-1.3.5.10-20.el7_3.x86_64.rpm

 

Red Hat Enterprise Linux Workstation (v. 7):

 

Source:

389-ds-base-1.3.5.10-20.el7_3.src.rpm

 

x86_64:

389-ds-base-1.3.5.10-20.el7_3.x86_64.rpm

389-ds-base-debuginfo-1.3.5.10-20.el7_3.x86_64.rpm

389-ds-base-libs-1.3.5.10-20.el7_3.x86_64.rpm

 

Red Hat Enterprise Linux Workstation Optional (v. 7):

 

x86_64:

389-ds-base-debuginfo-1.3.5.10-20.el7_3.x86_64.rpm

389-ds-base-devel-1.3.5.10-20.el7_3.x86_64.rpm

389-ds-base-snmp-1.3.5.10-20.el7_3.x86_64.rpm

 

These packages are GPG signed by Red Hat for security. Our key and

details on how to verify the signature are available from

https://access.redhat.com/security/team/key/

 

7. References:

 

https://access.redhat.com/security/cve/CVE-2017-2668

https://access.redhat.com/security/updates/classification/#important

 

8. Contact:

 

The Red Hat security contact is . More contact

details at https://access.redhat.com/security/team/contact/

 

Copyright 2017 Red Hat, Inc.

-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1

 

iD8DBQFY7n8HXlSAg2UNWIIRAkoNAKDE6GGYYqAzrqytX9kZaokV44XZ0ACeOWOe

THYzG9N5LL5bYhOy1/B+wHc=

=t9kU

-----END PGP SIGNATURE-----

 

 

--