Alerts This Week
Warning Icon 1 914
Alerts This Week
Warning Icon 1 914

Mageia: 2019-0152 Moderate: ldb Denial of Service Advisory

mageia
Calendar Grey May 7, 2019
Dist Mageia Esm H88
Mageia advises users to update ldb packages in response to a Denial of Service (DoS) vulnerability (CVE-2019-3824) for enhanced security measures
Garming Sam reported an out-of-bounds read in the ldb_wildcard_compare() function of ldb, resulting in denial of service (CVE-2019-3824)

Summary

Garming Sam reported an out-of-bounds read in the ldb_wildcard_compare() function of ldb, resulting in denial of service (CVE-2019-3824).
The ldb package has been updated to version 1.2.4 to fix this issue. The sssd and samba packages have been rebuilt against the updated ldb.
If a user was configured with no home directory set, sssd would return '/' (the root directory) instead of ' (the empty string / no home directory). This could impact services that restrict the user's filesystem access to within their home directory through chroot() etc. All versions before 2.1 are vulnerable. (CVE-2019-3811)

References

- https://bugs.mageia.org/show_bug.cgi?id=24478

- https://lists.debian.org/debian-security-announce/2019/msg00040.html

- http://lists.suse.com/pipermail/sle-security-updates/2019-March/005173.html

- - https://www.cve.org/CVERecord?id=CVE-2019-3811

- https://www.cve.org/CVERecord?id=CVE-2019-3824

Topics%20covered

Topics Covered

security advisory denial of service package update samba sssd Mageia ldb

Resolution

SRPMS

- 6/core/ldb-1.2.4-1.mga6

- 6/core/samba-4.7.12-1.2.mga6

- 6/core/sssd-1.13.4-9.5.mga6

Publication date: 07 May 2019
URL: https://advisories.mageia.org/MGASA-2019-0152.html
Type: security
CVE: CVE-2019-3811, CVE-2019-3824

Topics%20covered

Topics Covered

security advisory denial of service package update samba sssd Mageia ldb

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here