Mageia alert MGASA-2013-0263 (389-ds-base)

From:
    	     
 
Mageia Updates <buildsystem-daemon@mageia.org> 
To:
    	     
 
updates-announce@ml.mageia.org 
Subject:
    	     
 
[updates-announce] MGASA-2013-0263: Updated 389-ds-base packag fixes security vulnerabilies and incorrect group usage 
Date:
    	     
 
Fri, 30 Aug 2013 19:23:25 +0200
Message-ID:
    	     
 
<20130830172325.2A00648777@valstar.mageia.org>
Archive-link:
    	     
 
Article, Thread
              
MGASA-2013-0263 - Updated 389-ds-base packag fixes security vulnerabilies and incorrect group
usage

Publication date: 30 Aug 2013
URL: http://advisories.mageia.org/MGASA-2013-0263.html
Type: security
Affected Mageia releases: 3
CVE: CVE-2013-2219,
     CVE-2013-4283

Description:
Updated 389-ds-base packages fix security vulnerabilities:

It was discovered that the 389 Directory Server did not honor defined
attribute access controls when evaluating search filter expressions. A
remote attacker (with permission to query the Directory Server) could use
this flaw to determine the values of restricted attributes via a series of
search queries with filter conditions that used restricted attributes
(CVE-2013-2219).

It was discovered that the 389 Directory Server did not properly handle the
receipt of certain MOD operations with a bogus Distinguished Name (DN). A
remote, unauthenticated attacker could use this flaw to cause the 389
Directory Server to crash (CVE-2013-4283).

Additionally, problems of wrong default group nobody (from upstream) as well
as the 389-ds server not starting after a reboot have been fixed (mga#10138).

References:
- https://bugs.mageia.org/show_bug.cgi?id=10138
- https://bugs.mageia.org/show_bug.cgi?id=10889
- https://rhn.redhat.com/errata/RHSA-2013-1119.html
- https://rhn.redhat.com/errata/RHSA-2013-1182.html
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2219
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4283

SRPMS:
- 3/core/389-ds-base-1.3.0.8-1.mga3