Synopsis

Low: Red Hat Directory Server security and enhancement update

Type/Severity

Security Advisory: Low

Topic

Updated Red Hat Directory Server and related packages that fix one security
issue, multiple bugs, and add enhancements are now available as Red Hat
Directory Server 8.2.

The Red Hat Security Response Team has rated this update as having low
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

Description

Red Hat Directory Server is an LDAPv3-compliant directory server. The
redhat-ds-base package includes the LDAP server and command line utilities
for server administration.

Directory Server setup scripts created cache files, containing passwords
for the Directory and Administration Server administrative accounts, with
weak file permissions. A local user could use this flaw to obtain
authentication credentials for the administrative accounts. (CVE-2010-2241)

This update also adds the following enhancements:

• Entry USN - The Entry USN Plug-in provides a way for LDAP clients to know
  that something in the database has changed by generating a global update
  sequence number (USN) for every write operation.
  
• Linked Attributes - The new Linked Attributes Plug-in uses the DN value
  of a known attribute to trace its way to the referenced entry, and then it
  adds a reciprocal value, pointing back to the first entry.
  
• Bitwise Search - This release adds support for bit field values in LDAP
  searches.
  
• Dereference Control - This release adds server support for the
  dereference control in LDAP searches. A dereferencing search tracks back
  over cross-references in an entry and returns information about the
  referenced entry.
  
• PAM Pass-through Plug-in - The PAM PTA plug-in allows Directory Server to
  leverage a network's existing PAM service to authenticate users.
  
• SMD5 Password Storage Scheme - Passwords can now be stored with the
  salted MD5 password hash.
  
• Syntax Checking - A new syntax validation plug-in verifies that the value
  given for an attribute in an operation matches the required syntax for that
  attribute.
  
• Anonymous Resource Limits - A new server configuration attribute enables
  the Directory Server to apply resource limits to anonymous binds.
  
• Anonymous Access Switch - A new server configuration attribute tells the
  Directory Server to disable anonymous binds for added security.
  
• Secure Binds Switch - A new server configuration attribute tells the
  Directory Server to require a secure connection of some kind for any simple
  binds.
  
• SSF Restrictions - A new server configuration attribute allows
  administrators to set a minimum Security Strength Factor (SSF) for all
  connections to the server, which can require a secure connection.
  
• Mixed SASL/TLS Connections - Now, the server can have both SASL and TLS
  configured.
  
• Setting Plug-in Load Orders - A new plug-in configuration attribute sets
  the load order preference for the plug-in, anywhere from 1 to 99. This
  effectively sets the load order for plug-ins of the same type.
  
• Named Pipe Log Script - A new directory script allows logging data to be
  sent to a named pipe instead of the standard server logs.
  
• Simple Paged Results - This release adds server support for results of
  LDAP searches to be broken into pages.
  
• New Matching Rule and Attribute Syntaxes - This release adds support for
  several new matching rules and 11 new attribute syntaxes.
  

These packages also contain many bug fixes for major features in Red Hat
Directory Server, including replication, synchronization, setup and
migration, command line tools, the Java console, and the Administration
Server. Refer to the Red Hat Directory Server 8.2 Release Notes for further
information:

http://www.redhat.com/docs/manuals/dir-server/8.2/rel-notes/html

All Red Hat Directory Server users should upgrade to Red Hat Directory
Server 8.2, which resolves these issues and adds these enhancements.

Solution

Users running Red Hat Directory Server should consult the Red Hat Directory
Server 8.2 Release Notes for installation and upgrade instructions:

http://www.redhat.com/docs/manuals/dir-server/8.2/rel-notes/html

Affected Products

• Red Hat Directory Server 8 x86_64
• Red Hat Directory Server 8 i386

Fixes

• BZ - 608032 - CVE-2010-2241 redhat-ds: setup script insecure .inf file permissions

CVEs

• CVE-2010-2241

References

• http://www.redhat.com/security/updates/classification/#low
• http://www.redhat.com/docs/manuals/dir-server/8.2/rel-notes/html

Red Hat Directory Server 8

SRPM
jss-4.2.6-6.el5idm.src.rpm	SHA-256: 2084d67593f9e62cd1db565e3c31d6e9bebabd32bf57548edc865dc44ce18ccc
redhat-admin-console-8.2.0-2.el5dsrv.src.rpm	SHA-256: 7b3ff19e97d37025e12c6659187a6a16adbf3a942a70a81691c5b57d2b13f0d0
redhat-ds-8.2.0-2.el5dsrv.src.rpm	SHA-256: f16e222e3aad1d8806c75d1bc92eba845839be68b59799fef1b5eaee7918ecec
redhat-ds-admin-8.2.0-3.el5dsrv.src.rpm	SHA-256: ba72665dc16cfed24f1c0ddf0bbea1f7a6e8394a23657535194aad70b82a1fd0
redhat-ds-base-8.2.0-13.el5dsrv.src.rpm	SHA-256: 072aec1b6449a196c33e8d24ac8af65cf6a386084bc78a54aacba577401b66fc
redhat-ds-console-8.2.0-4.el5dsrv.src.rpm	SHA-256: a06c3d5874e0d8658bfdd1ec87c29b78fd743b9d4fa2ebd7029bbd475156466b
redhat-idm-console-1.0.2-1.el5idm.src.rpm	SHA-256: a6cd7d8598fe43fef4256a4b2c1d57db0fd1ff886644ab92cd61c0afd5c54427
x86_64
jss-4.2.6-6.el5idm.x86_64.rpm	SHA-256: ff0f083cfd4b872c2601cf40c91fc113a6f1ae85ba0e3cbbed88d54420593514
redhat-admin-console-8.2.0-2.el5dsrv.noarch.rpm	SHA-256: ab00b1ff49c0e678538ecdc4cd914982ca1da17c18b884995e4f6cdf83ae63cc
redhat-ds-8.2.0-2.el5dsrv.x86_64.rpm	SHA-256: 8615c568b2da3093c84eec86baacbdfafcb87cfd1032f91d3591d056b8562ad2
redhat-ds-admin-8.2.0-3.el5dsrv.x86_64.rpm	SHA-256: 415b68c2d3ad936a383489dadc04b3218e3f934bd5fb6208d12aa9f8f1189ac0
redhat-ds-base-8.2.0-13.el5dsrv.x86_64.rpm	SHA-256: 3b562d6ba7bb0b27a25e0fa5fee9762dc4fe5d4e11da1ae82ef27ac2f832b12b
redhat-ds-base-devel-8.2.0-13.el5dsrv.x86_64.rpm	SHA-256: 4b416aa47c067d1ef63b8af1ba2cc98dd0ef29c545bfac2b5c166932926d3f8d
redhat-ds-console-8.2.0-4.el5dsrv.noarch.rpm	SHA-256: 70531f3d27ac12f9a30d873e8891ad11a6b981ad30a613b7f6f76080d980b5e2
redhat-idm-console-1.0.2-1.el5idm.x86_64.rpm	SHA-256: 9d6d596491ab03affd1fb607afe8944544032549cb2f7b0c4c776246faee9964
i386
jss-4.2.6-6.el5idm.i386.rpm	SHA-256: 88cfe1b3bea683c5ee5267fa732793abb2904d7cde852c69d0a7e597b9684ac5
redhat-admin-console-8.2.0-2.el5dsrv.noarch.rpm	SHA-256: ab00b1ff49c0e678538ecdc4cd914982ca1da17c18b884995e4f6cdf83ae63cc
redhat-ds-8.2.0-2.el5dsrv.i386.rpm	SHA-256: 19c6c3c2c12dc64a9ed17178f58d4424616201e71120b9c9172a91356d738ade
redhat-ds-admin-8.2.0-3.el5dsrv.i386.rpm	SHA-256: 9582eb82bd14c0898d62b8eb78c0bec1e52163435430ec54f030e0c5e7789230
redhat-ds-base-8.2.0-13.el5dsrv.i386.rpm	SHA-256: 92e4b45e4d5c1d4271797f7ffaaf3025ef95356e2170b627dd341f05c8d95827
redhat-ds-base-devel-8.2.0-13.el5dsrv.i386.rpm	SHA-256: c277c0e4732f15c5c5ef61a66aaac1ac336465630df1135b64e17d816a676df6
redhat-ds-console-8.2.0-4.el5dsrv.noarch.rpm	SHA-256: 70531f3d27ac12f9a30d873e8891ad11a6b981ad30a613b7f6f76080d980b5e2
redhat-idm-console-1.0.2-1.el5idm.i386.rpm	SHA-256: 78775ab2f289b6e9a0487ea37f1e691588fff7459b92e8ac76d60c788d0b83e7