-----BEGIN PGP SIGNED MESSAGE-----

===========================================================================
              AUSCERT External Security Bulletin Redistribution
                             
                      ESB-2000.078 -- RHSA-2000:012-05
                       New openldap packages available
                                 04 May 2000

===========================================================================

Product:                openldap
Vendor:                 Red Hat
Operating System:       Red Hat Linux 6.1 
			Red Hat Linux 6.2
			Linux
			Unix
Platform:               x86, alpha, sparc

Impact:                 Modify arbitrary files
Access Required:        Local


- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----

- - ---------------------------------------------------------------------
                   Red Hat, Inc. Security Advisory

Synopsis:          New openldap packages.
Advisory ID:       RHSA-2000:012-05
Issue date:        2000-04-13
Updated on:        2000-04-21
Product:           Red Hat Linux
Keywords:          openldap startup symlink overwrite denial
Cross references:  N/A
- - ---------------------------------------------------------------------

1. Topic:

New openldap packages are available which fix a security
vulnerability in Red Hat Linux 6.1 and 6.2.

2. Relevant releases/architectures:

Red Hat Linux 6.1 - i386 alpha sparc
Red Hat Linux 6.2 - i386 alpha sparc


3. Problem description:

OpenLDAP follows symbolic links when creating files.  The default location for
these files is /usr/tmp, which is a symlink to /tmp, which in turn is a
world-writable directory.  Local users can destroy the contents of any file on any
mounted filesystem.

4. Solution:

For each RPM for your particular architecture, run:

rpm -Fvh [filename]

where filename is the name of the RPM.

Administrators with existing databases should also move their NEXTID and *.dbb
files from /usr/tmp to /var/lib/ldap, and verify that the 'directory' setting in
/etc/openldap/slapd.conf is changed accordingly.

5. Bug IDs fixed (http://bugzilla.redhat.com/bugzilla for more info):

10714 - Insecure file creation using static files which follow symlinks.


6. Obsoleted by:

N/A

7. Conflicts with:

N/A

8. RPMs required:


Red Hat Linux 6.1:

intel:
ftp://updates.redhat.com/6.1/i386/openldap-1.2.9-6.i386.rpm

alpha:
ftp://updates.redhat.com/6.1/alpha/openldap-1.2.9-6.alpha.rpm

sparc:
ftp://updates.redhat.com/6.1/sparc/openldap-1.2.9-6.sparc.rpm

sources:
ftp://updates.redhat.com/6.1/SRPMS/openldap-1.2.9-6.src.rpm

Red Hat Linux 6.2:

intel:
ftp://updates.redhat.com/6.2/i386/openldap-1.2.9-6.i386.rpm

alpha:
ftp://updates.redhat.com/6.2/alpha/openldap-1.2.9-6.alpha.rpm

sparc:
ftp://updates.redhat.com/6.2/sparc/openldap-1.2.9-6.sparc.rpm

sources:
ftp://updates.redhat.com/6.2/SRPMS/openldap-1.2.9-6.src.rpm


9. Verification:

MD5 sum                           Package Name
- - --------------------------------------------------------------------------
fa79c61565a72407db4695ef8468a482  6.1/alpha/openldap-1.2.9-6.alpha.rpm
058c4aa63710da7490f98da4b3cad53d  6.1/i386/openldap-1.2.9-6.i386.rpm
17fbdb33172a7884f56b4fc746b1b763  6.1/SRPMS/openldap-1.2.9-6.src.rpm
816fccd85990833f7c5dfb7f2dc6e0a1  6.1/sparc/openldap-1.2.9-6.sparc.rpm
fa79c61565a72407db4695ef8468a482  6.2/alpha/openldap-1.2.9-6.alpha.rpm
816fccd85990833f7c5dfb7f2dc6e0a1  6.2/sparc/openldap-1.2.9-6.sparc.rpm
17fbdb33172a7884f56b4fc746b1b763  6.2/SRPMS/openldap-1.2.9-6.src.rpm
058c4aa63710da7490f98da4b3cad53d  6.2/i386/openldap-1.2.9-6.i386.rpm


These packages are GPG signed by Red Hat, Inc. for security.  Our key
is available at:
    http://www.redhat.com/corp/contact.html

You can verify each package with the following command:
    rpm --checksig  <filename>

If you only wish to verify that each package has not been corrupted or
tampered with, examine only the md5sum with the following command:
    rpm --checksig --nogpg <filename>

10. References:

Thanks also go to Stan Bubrouski for reporting this problem.

Cristian
- - --
- - ----------------------------------------------------------------------
Cristian Gafton     --     gafton@redhat.com      --     Red Hat, Inc.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  "How could this be a problem in a country where we have Intel and 
   Microsoft?"  --Al Gore on Y2K

- -----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBOQCeJPGvxKXU9NkBAQFIAgP/fBO8WkawNk6qa2/1y3UO0o0t49xbBXPe
KM6qBojNW8yWKdsfGGgVkgvby/1gH+uFxd49mFNMbG8GUNIxOw8r2MfaQXERnnFb
IQ66mYSH5hesXw6wVnw0aIdnOMfd5BRpEZLXUnhrp+wf+IbtaQE6+g3MbmcoRSk4
jmsdnVhD6iQ=
=Yz4F
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content.  The decision to use any or all of this information is
the responsibility of each user or organisation, and should be done so in
accordance with site policies and procedures.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the original authors to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

	http://www.auscert.org.au/Information/advisories.html

If you believe that your system has been compromised, contact AusCERT or
your representative in FIRST (Forum of Incident Response and Security
Teams).

Internet Email: auscert@auscert.org.au
Facsimile:	(07) 3365 7031
Telephone:	(07) 3365 4417 (International: +61 7 3365 4417)
		AusCERT personnel answer during Queensland business hours
		which are GMT+10:00 (AEST).
		On call after hours for emergencies.


-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
Comment: ftp://ftp.auscert.org.au/pub/auscert/AUSCERT_PGP.key

iQCVAwUBOXXSGyh9+71yA2DNAQGT7wQAhCe6dKxo2gYB+M/wLaQuRfhL5axB9+wF
V2hx7r3pGkGi5iAhrXPrzUpprK0Ne2Nw2I+DksD8jp/zTS4qUqaYYMNzeF3iN9hI
OE4dF3fjvqxj5wzPnsjzfcCVWImo8Qm7DqkjsS8mYZksYdVWflXpBKaWGQFBA+et
k5+0qJWGLmU=
=M/GF
-----END PGP SIGNATURE-----