Alerts This Week
Warning Icon 1 714
Alerts This Week
Warning Icon 1 714

Red Hat 6: RHSA-2013:0503-03 Moderate: 389-Ds-Base ACL Issue

red hat
Calendar Grey February 21, 2013
Dist Redhat Esm H88
Moderate notification for Red Hat concerning 389-ds-base, featuring critical updates and improvements.
Updated 389-ds-base packages that fix one security issue, numerous bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6

Solution

Before applying this update, make sure all previously-released errata relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258

Summary

The 389-ds-base packages provide 389 Directory Server, which is an LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.
A flaw was found in the way 389 Directory Server enforced ACLs after performing an LDAP modify relative distinguished name (modrdn) operation. After modrdn was used to move part of a tree, the ACLs defined on the moved (Distinguished Name) were not properly enforced until the server was restarted. This could allow LDAP users to access information that should be restricted by the defined ACLs. (CVE-2012-4450)
This issue was discovered by Noriko Hosoi of Red Hat.
These updated 389-ds-base packages include numerous bug fixes and enhancements. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Enterprise Linux 6.4 Technical Notes, linked to in the References, for information on the most significant of these changes.
All users of 389-ds-base are advised to upgrade to these updated packages, which correct this issue and provide numerous bug fixes and enhancements. After installing this update, the 389 server service will be restarted automatically.

Topics%20covered

Topics Covered

security advisory moderate Red Hat ACL issue 389-ds-base

References

https://access.redhat.com/security/cve/CVE-2012-4450 https://access.redhat.com/security/updates/classification#moderate

Package List

Red Hat Enterprise Linux Desktop Optional (v. 6):
Source:
i386: 389-ds-base-1.2.11.15-11.el6.i686.rpm 389-ds-base-debuginfo-1.2.11.15-11.el6.i686.rpm 389-ds-base-devel-1.2.11.15-11.el6.i686.rpm 389-ds-base-libs-1.2.11.15-11.el6.i686.rpm
x86_64: 389-ds-base-1.2.11.15-11.el6.x86_64.rpm 389-ds-base-debuginfo-1.2.11.15-11.el6.i686.rpm 389-ds-base-debuginfo-1.2.11.15-11.el6.x86_64.rpm 389-ds-base-devel-1.2.11.15-11.el6.i686.rpm 389-ds-base-devel-1.2.11.15-11.el6.x86_64.rpm 389-ds-base-libs-1.2.11.15-11.el6.i686.rpm 389-ds-base-libs-1.2.11.15-11.el6.x86_64.rpm
Red Hat Enterprise Linux HPC Node Optional (v. 6):
Source:
x86_64: 389-ds-base-1.2.11.15-11.el6.x86_64.rpm 389-ds-base-debuginfo-1.2.11.15-11.el6.i686.rpm 389-ds-base-debuginfo-1.2.11.15-11.el6.x86_64.rpm 389-ds-base-devel-1.2.11.15-11.el6.i686.rpm 389-ds-base-devel-1.2.11.15-11.el6.x86_64.rpm 389-ds-base-libs-1.2.11.15-11.el6.i686.rpm 389-ds-base-libs-1.2.11.15-11.el6.x86_64.rpm
Red Hat Enterprise Linux Server (v. 6):
Source:
i386: 389-ds-base-1.2.11.15-11.el6.i686.rpm 389-ds-base-debuginfo-1.2.11.15-11.el6.i686.rpm 389-ds-base-libs-1.2.11.15-11.el6.i686.rpm
x86_64: 389-ds-base-1.2.11.15-11.el6.x86_64.rpm 389-ds-base-debuginfo-1.2.11.15-11.el6.i686.rpm 389-ds-base-debuginfo-1.2.11.15-11.el6.x86_64.rpm

Read the Full Advisory


Advisory ID: RHSA-2013:0503-03
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2013:0503.html
Issue date: 2013-02-21

Topic

Updated 389-ds-base packages that fix one security issue, numerous bugs,and add various enhancements are now available for Red Hat EnterpriseLinux 6.The Red Hat Security Response Team has rated this update as having moderatesecurity impact. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available from the CVE link inthe References section.

Topics%20covered

Topics Covered

security advisory moderate Red Hat ACL issue 389-ds-base

Relevant Releases Architectures

Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64

Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64

Red Hat Enterprise Linux Server (v. 6) - i386, x86_64

Red Hat Enterprise Linux Server Optional (v. 6) - i386, x86_64

Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64

Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64

Bugs Fixed

742054 - SASL/PLAIN binds do not work

746642 - [RFE] define pam_passthru service per subtree

757836 - logconv.pl restarts count on conn=0 instead of conn=1

768084 - [RFE] Allow automember to work on entries that have already been added

782975 - krbExtraData is being null modified and replicated on each ssh login

800051 - Rebase 389-ds-base to 1.2.11

818762 - winsync should not delete entry that appears to be out of scope

830256 - Audit log - clear text password in user changes

830331 - ns-slapd exits/crashes if /var fills up

830335 - restore of replica ldif file on second master after deleting two records shows only 1 deletion

830336 - db deadlock return should not log error

830337 - usn + mmr = deletions are not replicated

830338 - Change DS to purge ticket from krb cache in case of authentication error

830340 - Make the CLEANALLRUV task one step

830343 - managed entry sometimes doesn't delete the managed entry

830344 - [RFE] Improve replication agreement status messages

830346 - ADD operations not in audit log

830347 - 389 DS does not support multiple paging controls on a single connection

830348 - Slow shutdown when you have 100+ replication agreements

830349 - cannot use & in a sasl map search filter

830353 - valgrind reported memleaks and mem errors830355 - [RFE] improve cleanruv functionality

830356 - coverity 12625-12629 - leaks, dead code, unchecked return

Read the Full Advisory

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here