Custom Query (196 matches)

Quentin writes: """We are probably being affected by this. We currently have nss_ldap-257-3 installed, which may or may not include the patch that's in -258 to fix this.""" and forwards the email below.

Was ​https://help.mit.edu/?q=531080.

Date: Sun, 25 Nov 2007 22:43:56 +0100 From: Pierre-Yves Rofes <py@…> To: gentoo-announce@… Cc: full-disclosure@…, bugtraq@…, security-alerts@… Subject: [gentoo-announce] [ GLSA 200711-33 ] nss_ldap: Information disclosure

Hash: SHA1

• - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Gentoo Linux Security Advisory GLSA 200711-33

• - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

​http://security.gentoo.org/

• - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Low Title: nss_ldap: Information disclosure Date: November 25, 2007 Bugs: #198390 ID: 200711-33

• - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis ========

A race condition might lead to theft of user credentials or information disclosure in services using nss_ldap.

Background ==========

nss_ldap is a Name Service Switch module which allows 'passwd', 'group' and 'host' database information to be pulled from LDAP.

Affected packages =================

Package / Vulnerable / Unaffected

1 sys-auth/nss_ldap < 258 >= 258

Description ===========

Josh Burley reported that nss_ldap does not properly handle the LDAP connections due to a race condition that can be triggered by multi-threaded applications using nss_ldap, which might lead to requested data being returned to a wrong process.

Impact ======

Remote attackers could exploit this race condition by sending queries to a vulnerable server using nss_ldap, possibly leading to theft of user credentials or information disclosure (e.g. Dovecot returning wrong mailbox contents).

Workaround ==========

There is no known workaround at this time.

Resolution ==========

All nss_ldap users should upgrade to the latest version:

# emerge --sync # emerge --ask --oneshot --verbose ">=sys-auth/nss_ldap-258"

References ==========

[ 1 ] CVE-2007-5794 ​http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5794

Availability ============

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

​http://security.gentoo.org/glsa/glsa-200711-33.xml

Concerns? =========

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@… or alternatively, you may file a bug at ​http://bugs.gentoo.org.

License =======

Copyright 2007 Gentoo Foundation, Inc; referenced text belongs to its owner(s).

The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.

​http://creativecommons.org/licenses/by-sa/2.5

Version: GnuPG v1.4.7 (GNU/Linux) Comment: Using GnuPG with Mozilla - ​http://enigmail.mozdev.org

iD8DBQFHSeycuhJ+ozIKI5gRAjvwAKCc3Et4rezJasP3RT7sWY+pHyShwACfVwbg 67oYKwgTwEYBnnY/v5ZQ5zw= =TEDE

-- gentoo-announce@… mailing list

(Imported from ​help.mit.edu #492117.)

tabbott:

Something else seems to have changed in the ssh configuration. Now when I ssh from an Athena workstation (which auto-xforwards) I get a really long delay followed by an xauth timeout.

andersk:

Hmm. I disabled X11Forwarding on the primary server for now. This reduced but did not eliminate the delay (i.e. there's still a huge difference between ssh and ssh -o ForwardX11=no), so I'm not entirely sure what's going on. I don't see the delay from my machine or mega-man.

(Imported from ​help.mit.edu #547795.)

abhagi:

Also, can one upload JSP files onto scripts.mit.edu?

geofft:

We do not run a Tomcat installation the same way we run an Apache httpd installation on scripts; Tomcat does not allow us to do security isolation between users in the same manner, so we cannot set up a multiuser installation. There is an Apache-httpd module (mod_proxy_ajp) that appears to allow running JSP scripts, but we are not yet sure whether this properly and securely isolates user accounts. We will try to take a look at this sometime soon and determine whether this method is a practical solution; other users have expressed some interest in running JSP pages on scripts.