Synopsis

Important: redhat-idm-console security update

Type/Severity

Security Advisory: Important

Topic

Updated redhat-idm-console packages that fix a security issue are now
available for Red Hat Directory Server 8.0.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

Description

The redhat-idm-console contains a Java based remote management console used
for managing Red Hat Administration Server and Red Hat Directory Server.

When running on Red Hat Enterprise Linux, Red Hat Directory Server 8.0 used
insecure permissions on the redhat-idm-console startup script. Local users
could modify this script and run arbitrary code with the privileges of the
user running Red Hat Management Console (CVE-2008-0889).

Red Hat would like to thank Doncho N. Gunchev for reporting this issue.

All redhat-idm-console users are advised to update to these erratum
packages which contain a fix to correct this issue.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

Affected Products

• Red Hat Directory Server 8 x86_64
• Red Hat Directory Server 8 i386

Fixes

• BZ - 436107 - CVE-2008-0889 directory server: insecure permissions on fedora/redhat-idm-console

CVEs

• CVE-2008-0889

References

• http://www.redhat.com/security/updates/classification/#important

Red Hat Directory Server 8

SRPM
redhat-idm-console-1.0.0-17.el5idm.src.rpm	SHA-256: a47349b3f3b31637a52a8da054343022c4643d9de3525a6c5b8a68a5c2e73e58
x86_64
redhat-idm-console-1.0.0-17.el5idm.x86_64.rpm	SHA-256: ca1e21ddbbf8bef640ca6c0970e196cc4f09b80a47e63bd21123b5c2fb2f9210
i386
redhat-idm-console-1.0.0-17.el5idm.i386.rpm	SHA-256: 5e4db70039b31293962a5b4f30571792575b57a18a2e7f1fd7a4735433319704