-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                         ESB-2008.0836 -- [RedHat]
   Critical: Red Hat Directory Server 7.1 Service Pack 7 security update
                              28 August 2008

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:              redhat-ds
Publisher:            Red Hat
Operating System:     Red Hat Linux 3
Impact:               Execute Arbitrary Code/Commands
                      Cross-site Scripting
                      Denial of Service
Access:               Remote/Unauthenticated
CVE Names:            CVE-2008-3283 CVE-2008-2930 CVE-2008-2929
                      CVE-2008-2928

Ref:                  ESB-2008.0833

Original Bulletin:    https://rhn.redhat.com/errata/RHSA-2008-0596.html

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Critical: Red Hat Directory Server 7.1 Service Pack 7 security update
Advisory ID:       RHSA-2008:0596-01
Product:           Red Hat Directory Server
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2008-0596.html
Issue date:        2008-08-27
CVE Names:         CVE-2008-2928 CVE-2008-2929 CVE-2008-2930 
                   CVE-2008-3283 
=====================================================================

1. Summary:

An updated redhat-ds package that fixes various security issues is now
available as Red Hat Directory Server 7.1, Service Pack 7.

This update has been rated as having critical security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Directory Server 7.1 (for AS v. 3) - i386
RHEL 3 Directory Server ES - i386
RHEL 4 Directory Server AS - i386
RHEL 4 Directory Server ES - i386

3. Description:

Red Hat Directory Server is an LDAPv3-compliant directory server.

Multiple CGI applications distributed with Red Hat Directory Server were
affected by a buffer overflow flaw in the routine used to parse
Accept-Language HTTP headers. A remote attacker with access to the
Administration Server web interface could use this flaw to crash these CGI
applications or, potentially, execute arbitrary code with the privileges of
the Administration Server. Note: Red Hat Directory Server 7.1 runs the
Administration Server as the root user. (CVE-2008-2928)

Multiple cross-site scripting flaws were discovered in the Directory Server
Administration Express and Directory Server Gateway (DSGW) web interface,
caused by an incorrect parsing of "%" character-escaped user-provided
values. A remote attacker could use these flaws to conduct cross-site
scripting attacks against Directory Server users or administrators using
these web services. (CVE-2008-2929)

Multiple memory leaks were identified in the Directory Server. An
unauthenticated remote attacker could use these flaws to trigger high
memory consumption in the Directory Server, possibly causing it to crash or
terminate unexpectedly when running out of available memory. (CVE-2008-3283)

Ulf Weltman of Hewlett Packard discovered a flaw in the way Directory
Server handled LDAP search requests with patterns. A remote attacker with
access to the LDAP service could create a search request that, when the
search pattern was matched against specially crafted data records, caused
Directory Server to use a large amount of CPU time. Directory Server did
not impose time limits on such search requests. In this updated package,
Directory Server imposes a configurable limit on the pattern-search query
run time, with the default limit set to 30 seconds. (CVE-2008-2930)

In addition to these security fixes, the following bugs have been fixed in
Red Hat Directory Server 7.1, Service Pack 7:

* A modified accountUnlockTime attribute caused by multiple single-user
login failures caused replication to fail, requiring administrator
intervention. Red Hat Directory Server 7.1 Service Pack 7 solves the
replication failure issue in these situations.

* The change sequence numbers in multi-master replication had a built-in
time skew to accommodate differences in the clocks on master servers. Under
certain circumstances, this skew exceeded the maximum allowable skew,
causing replication to stop entirely. In Service Pack 7, this has been fixed.

* In replication scenarios, if an attribute value was scheduled to be
deleted and also was indexed or had an attribute subtype which was indexed,
the Directory Server would crash during the index operation.

* The stack memory size limit used on 64-bit systems was limited to 256KB.
Directory Server could use all the stack memory while performing regular
operations, resulting in slapd daemon crash. 

For more information about Service Pack 7, including upgrade and
installation instructions for users running Red Hat Directory Server 7.1 on
Solaris, refer to the Red Hat Directory Server 7.1 SP7 release notes, which
are linked to in the "References" section of this erratum.

All users of Red Hat Directory Server 7.1 should upgrade to Service Pack 7,
which resolves these issues. 

4. Solution:

This update is available via Red Hat Network.

Users running Red Hat Directory Server 7.1 on Red Hat Enterprise Linux
should consult the following Knowledge Base article for instruction on how
to install updated RPM packages: 

http://kbase.redhat.com/faq/FAQ_58_10188

Users running Red Hat Directory Server 7.1 on Solaris should consult the
Service Pack 7 release notes for installation and upgrade instructions.
These release notes are linked to in the "References" section of this erratum.

5. Bugs fixed (http://bugzilla.redhat.com/):

453916 - CVE-2008-2928 Directory Server: CGI accept language buffer overflow
454065 - CVE-2008-2930 Directory Server: temporary DoS via crafted pattern searches
454621 - CVE-2008-2929 Directory Server: multiple XSS issues
458977 - CVE-2008-3283 Directory Server: multiple memory leaks

6. Package List:

Red Hat Directory Server 7.1 (for AS v. 3):

i386:
redhat-ds-7.1SP7-14.RHEL3.i386.rpm

RHEL 3 Directory Server ES:

i386:
redhat-ds-7.1SP7-14.RHEL3.i386.rpm

RHEL 4 Directory Server AS:

i386:
redhat-ds-7.1SP7-14.RHEL4.i386.rpm

RHEL 4 Directory Server ES:

i386:
redhat-ds-7.1SP7-14.RHEL4.i386.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2928
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2929
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2930
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3283
http://www.redhat.com/security/updates/classification/#critical
http://www.redhat.com/docs/manuals/dir-server/release-notes/7.1SP7/index.html

8. Contact:

The Red Hat security contact is <secalert@redhat.com>.  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2008 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFItcNdXlSAg2UNWIIRAqBlAJ0YGWi7lvYS4BmKImnx0ux/KtWLkgCgsQ53
/B4CkWecabo7XZu0Pz0ybow=
=gdu9
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBSLY42yh9+71yA2DNAQKScQP/d78VHR9jS5r6rKDAdDISNOymcntRxPbv
imcU97A4WjDIPKbz8UTcF1vRJzVW730FU7grOeLkx0Tz7EojRKVTigp7scWLCcUc
z/zA9Dra0ZvvKFtJeERsEEzgUQGA552pmI9d3AmMPw2ypDIwrVT5jl0UK7P6OH+I
69bDiEYcHKM=
=Tfcu
-----END PGP SIGNATURE-----