RHSA-2012:0813 - Security Advisory

Topic

Updated 389-ds-base packages that fix one security issue, several bugs, and
add various enhancements are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having low
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

Description

The 389 Directory Server is an LDAPv3 compliant server. The base packages
include the Lightweight Directory Access Protocol (LDAP) server and
command-line utilities for server administration.

A flaw was found in the way the 389 Directory Server daemon (ns-slapd)
handled access control instructions (ACIs) using certificate groups. If an
LDAP user that had a certificate group defined attempted to bind to the
directory server, it would cause ns-slapd to enter an infinite loop and
consume an excessive amount of CPU time. (CVE-2012-0833)

Red Hat would like to thank Graham Leggett for reporting this issue.

These updated 389-ds-base packages also include numerous bug fixes and
enhancements. Space precludes documenting all of these changes in this
advisory. Users are directed to the Red Hat Enterprise Linux 6.3 Technical
Notes for information on the most significant of these changes.

Users are advised to upgrade to these updated 389-ds-base packages, which
resolve these issues and add these enhancements. After installing this
update, the 389 server service will be restarted automatically.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386

Fixes

• BZ - 766322 - [RFE] Please support setting defaultNamingContext in the rootdse.
• BZ - 768086 - [RFE] minssf should not apply to rootdse
• BZ - 768091 - [RFE] Permit 'Delete' operation for Managed Entry Config entries
• BZ - 772777 - pre compile and normalize search filter
• BZ - 772778 - acl cache overflown problem
• BZ - 772779 - bak2db gets stuck in infinite loop
• BZ - 781529 - Managed Entry Plugin runs against managed entries upon any update without validating
• BZ - 781534 - Review and address latest Coverity issues
• BZ - 784343 - upgrade needs better check for "server is running"
• BZ - 784344 - repl-monitor doesn't work if leftmost hostnames are the same
• BZ - 787014 - CVE-2012-0833 389: denial of service when using certificate groups
• BZ - 788140 - cannot set repl referrals or state
• BZ - 788722 - problematic copyright information on 389-ds-base/ldap/servers/snmp/*
• BZ - 788723 - TLS not working with latest openldap
• BZ - 788724 - extensible binary filters do not work
• BZ - 788725 - filter normalization does not use matching rules
• BZ - 788726 - Schema replication update failed: Invalid syntax
• BZ - 788728 - Invalid read reported by valgrind
• BZ - 788729 - Reindexing entryrdn fails if ancestors are also tombstoned
• BZ - 788731 - ruv tombstone searches don't work after reindex entryrdn
• BZ - 788732 - add tombstonenumsubordinates to schema
• BZ - 788741 - 389 DS DNA Plugin / Replication failing on GSSAPI
• BZ - 788745 - Data inconsitency during replication
• BZ - 788749 - Log not clear enough on schema errors
• BZ - 788750 - nisDomain schema is incorrect, causes errors upon upgrade
• BZ - 788751 - Account Policy Plugin does not work for simple binds when PAM Pass Through Auth plugin is enabled
• BZ - 788753 - aci on cn=monitor warning about connection attribute
• BZ - 788755 - FQDN set to nsslapd-listenhost makes the server start fail if IPv4-mapped-IPv6 address is given
• BZ - 788756 - Manpages fixes
• BZ - 788760 - [RFE] Logconv improvements
• BZ - 788764 - 389 programs linked against openldap crash during shutdown
• BZ - 790433 - [RFE] Automemberships
• BZ - 790491 - 389 DS Segfaults during replica install in FreeIPA
• BZ - 800215 - Certain CMP operations hang or cause ns-slapd to crash
• BZ - 800217 - fix valgrind reported issues
• BZ - 803930 - ipa not starting after upgade because of missing data
• BZ - 811291 - [abrt] 389-ds-base-1.2.10.4-2.fc16: index_range_read_ext: Process /usr/sbin/ns-slapd was killed by signal 11 (SIGSEGV)
• BZ - 813964 - IPA dirsvr seg-fault during system longevity test
• BZ - 815991 - crash in ldap_initialize with multiple threads
• BZ - 819643 - Database RUV could mismatch the one in changelog under the stress
• BZ - 821176 - ns-slapd segfault in libreplication-plugin after IPA upgrade from 2.1.3 to 2.2.0
• BZ - 821542 - letters in object's cn get converted to lowercase when renaming object
• BZ - 822700 - Bad DNs in ACIs can segfault ns-slapd
• BZ - 824014 - DS Shuts down intermittently

CVEs

• CVE-2012-0833

References

• https://access.redhat.com/security/updates/classification/#low
• https://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/6.3_Technical_Notes/pkg-389-ds-base.html#RHSA-2012-0813