Advisories ยป MGASA-2013-0263

Updated 389-ds-base packag fixes security vulnerabilies and incorrect group usage

Publication date: 30 Aug 2013
Modification date: 30 Aug 2013
Type: security
Affected Mageia releases : 3
CVE: CVE-2013-2219 , CVE-2013-4283

Description

Updated 389-ds-base packages fix security vulnerabilities:

It was discovered that the 389 Directory Server did not honor defined
attribute access controls when evaluating search filter expressions. A
remote attacker (with permission to query the Directory Server) could use
this flaw to determine the values of restricted attributes via a series of
search queries with filter conditions that used restricted attributes
(CVE-2013-2219).

It was discovered that the 389 Directory Server did not properly handle the
receipt of certain MOD operations with a bogus Distinguished Name (DN). A
remote, unauthenticated attacker could use this flaw to cause the 389
Directory Server to crash (CVE-2013-4283).

Additionally, problems of wrong default group nobody (from upstream) as well
as the 389-ds server not starting after a reboot have been fixed (mga#10138).

References

SRPMS

3/core