upgrade nss_ldap out of a vulnerability

[price]

Quentin writes: """We are probably being affected by this. We currently have nss_ldap-257-3 installed, which may or may not include the patch that's in -258 to fix this.""" and forwards the email below.

Was ​https://help.mit.edu/?q=531080.

---

Date: Sun, 25 Nov 2007 22:43:56 +0100 From: Pierre-Yves Rofes <py@…> To: gentoo-announce@… Cc: full-disclosure@…, bugtraq@…, security-alerts@… Subject: [gentoo-announce] [ GLSA 200711-33 ] nss_ldap: Information disclosure

---

Hash: SHA1

• - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Gentoo Linux Security Advisory GLSA 200711-33

• - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

​http://security.gentoo.org/

• - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Low Title: nss_ldap: Information disclosure Date: November 25, 2007 Bugs: #198390 ID: 200711-33

• - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis ========

A race condition might lead to theft of user credentials or information disclosure in services using nss_ldap.

Background ==========

nss_ldap is a Name Service Switch module which allows 'passwd', 'group' and 'host' database information to be pulled from LDAP.

Affected packages =================

---

Package / Vulnerable / Unaffected

---

1 sys-auth/nss_ldap < 258 >= 258

Description ===========

Josh Burley reported that nss_ldap does not properly handle the LDAP connections due to a race condition that can be triggered by multi-threaded applications using nss_ldap, which might lead to requested data being returned to a wrong process.

Impact ======

Remote attackers could exploit this race condition by sending queries to a vulnerable server using nss_ldap, possibly leading to theft of user credentials or information disclosure (e.g. Dovecot returning wrong mailbox contents).

Workaround ==========

There is no known workaround at this time.

Resolution ==========

All nss_ldap users should upgrade to the latest version:

# emerge --sync # emerge --ask --oneshot --verbose ">=sys-auth/nss_ldap-258"

References ==========

[ 1 ] CVE-2007-5794 ​http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5794

Availability ============

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

​http://security.gentoo.org/glsa/glsa-200711-33.xml

Concerns? =========

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@… or alternatively, you may file a bug at ​http://bugs.gentoo.org.

License =======

Copyright 2007 Gentoo Foundation, Inc; referenced text belongs to its owner(s).

The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.

​http://creativecommons.org/licenses/by-sa/2.5

---

Version: GnuPG v1.4.7 (GNU/Linux) Comment: Using GnuPG with Mozilla - ​http://enigmail.mozdev.org

iD8DBQFHSeycuhJ+ozIKI5gRAjvwAKCc3Et4rezJasP3RT7sWY+pHyShwACfVwbg 67oYKwgTwEYBnnY/v5ZQ5zw= =TEDE

---

-- gentoo-announce@… mailing list

[andersk]

The two Red Hat bugs referring to this CVE-2007-5794 are still open (​Red Hat #155187, ​Red Hat #367461).

[quentin]

Fedora and Red Hat both haven't released an updated patch, but I can confirm that they are vulnerable. I'm going to suggest waiting until upstream releases a patch

[quentin]

We now use nss-ldapd.