Updated 389-ds-base packag fixes security vulnerabilies and incorrect group usage
Publication date: 30 Aug 2013Modification date: 30 Aug 2013
Type: security
Affected Mageia releases : 3
CVE: CVE-2013-2219 , CVE-2013-4283
Description
Updated 389-ds-base packages fix security vulnerabilities: It was discovered that the 389 Directory Server did not honor defined attribute access controls when evaluating search filter expressions. A remote attacker (with permission to query the Directory Server) could use this flaw to determine the values of restricted attributes via a series of search queries with filter conditions that used restricted attributes (CVE-2013-2219). It was discovered that the 389 Directory Server did not properly handle the receipt of certain MOD operations with a bogus Distinguished Name (DN). A remote, unauthenticated attacker could use this flaw to cause the 389 Directory Server to crash (CVE-2013-4283). Additionally, problems of wrong default group nobody (from upstream) as well as the 389-ds server not starting after a reboot have been fixed (mga#10138).
References
- https://bugs.mageia.org/show_bug.cgi?id=10138
- https://bugs.mageia.org/show_bug.cgi?id=10889
- https://rhn.redhat.com/errata/RHSA-2013-1119.html
- https://rhn.redhat.com/errata/RHSA-2013-1182.html
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2219
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4283
SRPMS
3/core
- 389-ds-base-1.3.0.8-1.mga3