[RHSA-2008:0596-01] Critical: Red Hat Directory Server 7.1 Service Pack 7 security update

Wed Aug 27 21:13:20 UTC 2008

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Critical: Red Hat Directory Server 7.1 Service Pack 7 security update
Advisory ID:       RHSA-2008:0596-01
Product:           Red Hat Directory Server
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2008-0596.html
Issue date:        2008-08-27
CVE Names:         CVE-2008-2928 CVE-2008-2929 CVE-2008-2930 
                   CVE-2008-3283 
=====================================================================

1. Summary:

An updated redhat-ds package that fixes various security issues is now
available as Red Hat Directory Server 7.1, Service Pack 7.

This update has been rated as having critical security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Directory Server 7.1 (for AS v. 3) - i386
RHEL 3 Directory Server ES - i386
RHEL 4 Directory Server AS - i386
RHEL 4 Directory Server ES - i386

3. Description:

Red Hat Directory Server is an LDAPv3-compliant directory server.

Multiple CGI applications distributed with Red Hat Directory Server were
affected by a buffer overflow flaw in the routine used to parse
Accept-Language HTTP headers. A remote attacker with access to the
Administration Server web interface could use this flaw to crash these CGI
applications or, potentially, execute arbitrary code with the privileges of
the Administration Server. Note: Red Hat Directory Server 7.1 runs the
Administration Server as the root user. (CVE-2008-2928)

Multiple cross-site scripting flaws were discovered in the Directory Server
Administration Express and Directory Server Gateway (DSGW) web interface,
caused by an incorrect parsing of "%" character-escaped user-provided
values. A remote attacker could use these flaws to conduct cross-site
scripting attacks against Directory Server users or administrators using
these web services. (CVE-2008-2929)

Multiple memory leaks were identified in the Directory Server. An
unauthenticated remote attacker could use these flaws to trigger high
memory consumption in the Directory Server, possibly causing it to crash or
terminate unexpectedly when running out of available memory. (CVE-2008-3283)

Ulf Weltman of Hewlett Packard discovered a flaw in the way Directory
Server handled LDAP search requests with patterns. A remote attacker with
access to the LDAP service could create a search request that, when the
search pattern was matched against specially crafted data records, caused
Directory Server to use a large amount of CPU time. Directory Server did
not impose time limits on such search requests. In this updated package,
Directory Server imposes a configurable limit on the pattern-search query
run time, with the default limit set to 30 seconds. (CVE-2008-2930)

In addition to these security fixes, the following bugs have been fixed in
Red Hat Directory Server 7.1, Service Pack 7:

* A modified accountUnlockTime attribute caused by multiple single-user
login failures caused replication to fail, requiring administrator
intervention. Red Hat Directory Server 7.1 Service Pack 7 solves the
replication failure issue in these situations.

* The change sequence numbers in multi-master replication had a built-in
time skew to accommodate differences in the clocks on master servers. Under
certain circumstances, this skew exceeded the maximum allowable skew,
causing replication to stop entirely. In Service Pack 7, this has been fixed.

* In replication scenarios, if an attribute value was scheduled to be
deleted and also was indexed or had an attribute subtype which was indexed,
the Directory Server would crash during the index operation.

* The stack memory size limit used on 64-bit systems was limited to 256KB.
Directory Server could use all the stack memory while performing regular
operations, resulting in slapd daemon crash. 

For more information about Service Pack 7, including upgrade and
installation instructions for users running Red Hat Directory Server 7.1 on
Solaris, refer to the Red Hat Directory Server 7.1 SP7 release notes, which
are linked to in the "References" section of this erratum.

All users of Red Hat Directory Server 7.1 should upgrade to Service Pack 7,
which resolves these issues. 

4. Solution:

This update is available via Red Hat Network.

Users running Red Hat Directory Server 7.1 on Red Hat Enterprise Linux
should consult the following Knowledge Base article for instruction on how
to install updated RPM packages: 

http://kbase.redhat.com/faq/FAQ_58_10188

Users running Red Hat Directory Server 7.1 on Solaris should consult the
Service Pack 7 release notes for installation and upgrade instructions.
These release notes are linked to in the "References" section of this erratum.

5. Bugs fixed (http://bugzilla.redhat.com/):

453916 - CVE-2008-2928 Directory Server: CGI accept language buffer overflow
454065 - CVE-2008-2930 Directory Server: temporary DoS via crafted pattern searches
454621 - CVE-2008-2929 Directory Server: multiple XSS issues
458977 - CVE-2008-3283 Directory Server: multiple memory leaks

6. Package List:

Red Hat Directory Server 7.1 (for AS v. 3):

i386:
redhat-ds-7.1SP7-14.RHEL3.i386.rpm

RHEL 3 Directory Server ES:

i386:
redhat-ds-7.1SP7-14.RHEL3.i386.rpm

RHEL 4 Directory Server AS:

i386:
redhat-ds-7.1SP7-14.RHEL4.i386.rpm

RHEL 4 Directory Server ES:

i386:
redhat-ds-7.1SP7-14.RHEL4.i386.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2928
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2929
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2930
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3283
http://www.redhat.com/security/updates/classification/#critical
http://www.redhat.com/docs/manuals/dir-server/release-notes/7.1SP7/index.html

8. Contact:

The Red Hat security contact is <secalert at redhat.com>.  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2008 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFItcNdXlSAg2UNWIIRAqBlAJ0YGWi7lvYS4BmKImnx0ux/KtWLkgCgsQ53
/B4CkWecabo7XZu0Pz0ybow=
=gdu9
-----END PGP SIGNATURE-----