Opened 14 years ago

Closed 13 years ago

#30 closed defect (wontfix)

upgrade nss_ldap out of a vulnerability

Reported by: price Owned by:
Priority: normal Milestone:
Component: misc Keywords:
Cc:

Description

Quentin writes: """We are probably being affected by this. We currently have nss_ldap-257-3 installed, which may or may not include the patch that's in -258 to fix this.""" and forwards the email below.

Was https://help.mit.edu/?q=531080.


Date: Sun, 25 Nov 2007 22:43:56 +0100 From: Pierre-Yves Rofes <py@…> To: gentoo-announce@… Cc: full-disclosure@…, bugtraq@…, security-alerts@… Subject: [gentoo-announce] [ GLSA 200711-33 ] nss_ldap: Information disclosure


Hash: SHA1

  • - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Gentoo Linux Security Advisory GLSA 200711-33

  • - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

http://security.gentoo.org/

  • - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Low Title: nss_ldap: Information disclosure Date: November 25, 2007 Bugs: #198390 ID: 200711-33

  • - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis ========

A race condition might lead to theft of user credentials or information disclosure in services using nss_ldap.

Background ==========

nss_ldap is a Name Service Switch module which allows 'passwd', 'group' and 'host' database information to be pulled from LDAP.

Affected packages =================


Package / Vulnerable / Unaffected


1 sys-auth/nss_ldap < 258 >= 258

Description ===========

Josh Burley reported that nss_ldap does not properly handle the LDAP connections due to a race condition that can be triggered by multi-threaded applications using nss_ldap, which might lead to requested data being returned to a wrong process.

Impact ======

Remote attackers could exploit this race condition by sending queries to a vulnerable server using nss_ldap, possibly leading to theft of user credentials or information disclosure (e.g. Dovecot returning wrong mailbox contents).

Workaround ==========

There is no known workaround at this time.

Resolution ==========

All nss_ldap users should upgrade to the latest version:

# emerge --sync # emerge --ask --oneshot --verbose ">=sys-auth/nss_ldap-258"

References ==========

[ 1 ] CVE-2007-5794 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5794

Availability ============

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200711-33.xml

Concerns? =========

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@… or alternatively, you may file a bug at http://bugs.gentoo.org.

License =======

Copyright 2007 Gentoo Foundation, Inc; referenced text belongs to its owner(s).

The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5


Version: GnuPG v1.4.7 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFHSeycuhJ+ozIKI5gRAjvwAKCc3Et4rezJasP3RT7sWY+pHyShwACfVwbg 67oYKwgTwEYBnnY/v5ZQ5zw= =TEDE


-- gentoo-announce@… mailing list

Change History (3)

comment:1 Changed 14 years ago by andersk

The two Red Hat bugs referring to this CVE-2007-5794 are still open (Red Hat #155187, Red Hat #367461).

comment:2 Changed 14 years ago by quentin

Fedora and Red Hat both haven't released an updated patch, but I can confirm that they are vulnerable. I'm going to suggest waiting until upstream releases a patch

comment:3 Changed 13 years ago by quentin

  • Resolution set to wontfix
  • Status changed from new to closed

We now use nss-ldapd.

Note: See TracTickets for help on using tickets.