RHSA-2013:0503 - Security Advisory

Topic

Updated 389-ds-base packages that fix one security issue, numerous bugs,
and add various enhancements are now available for Red Hat Enterprise
Linux 6.

The Red Hat Security Response Team has rated this update as having moderate
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

Description

The 389-ds-base packages provide 389 Directory Server, which is an LDAPv3
compliant server. The base packages include the Lightweight Directory
Access Protocol (LDAP) server and command-line utilities for server
administration.

A flaw was found in the way 389 Directory Server enforced ACLs after
performing an LDAP modify relative distinguished name (modrdn) operation.
After modrdn was used to move part of a tree, the ACLs defined on the moved
(Distinguished Name) were not properly enforced until the server was
restarted. This could allow LDAP users to access information that should be
restricted by the defined ACLs. (CVE-2012-4450)

This issue was discovered by Noriko Hosoi of Red Hat.

These updated 389-ds-base packages include numerous bug fixes and
enhancements. Space precludes documenting all of these changes in this
advisory. Users are directed to the Red Hat Enterprise Linux 6.4
Technical Notes, linked to in the References, for information on the most
significant of these changes.

All users of 389-ds-base are advised to upgrade to these updated packages,
which correct this issue and provide numerous bug fixes and enhancements.
After installing this update, the 389 server service will be restarted
automatically.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386

Fixes

• BZ - 742054 - SASL/PLAIN binds do not work
• BZ - 746642 - [RFE] define pam_passthru service per subtree
• BZ - 757836 - logconv.pl restarts count on conn=0 instead of conn=1
• BZ - 768084 - [RFE] Allow automember to work on entries that have already been added
• BZ - 782975 - krbExtraData is being null modified and replicated on each ssh login
• BZ - 800051 - Rebase 389-ds-base to 1.2.11
• BZ - 818762 - winsync should not delete entry that appears to be out of scope
• BZ - 830256 - Audit log - clear text password in user changes
• BZ - 830331 - ns-slapd exits/crashes if /var fills up
• BZ - 830335 - restore of replica ldif file on second master after deleting two records shows only 1 deletion
• BZ - 830336 - db deadlock return should not log error
• BZ - 830337 - usn + mmr = deletions are not replicated
• BZ - 830338 - Change DS to purge ticket from krb cache in case of authentication error
• BZ - 830340 - Make the CLEANALLRUV task one step
• BZ - 830343 - managed entry sometimes doesn't delete the managed entry
• BZ - 830344 - [RFE] Improve replication agreement status messages
• BZ - 830346 - ADD operations not in audit log
• BZ - 830347 - 389 DS does not support multiple paging controls on a single connection
• BZ - 830348 - Slow shutdown when you have 100+ replication agreements
• BZ - 830349 - cannot use & in a sasl map search filter
• BZ - 830353 - valgrind reported memleaks and mem errors
• BZ - 830355 - [RFE] improve cleanruv functionality
• BZ - 830356 - coverity 12625-12629 - leaks, dead code, unchecked return
• BZ - 832560 - [abrt] 389-ds-base-1.2.10.6-1.fc16: slapi_attr_value_cmp: Process /usr/sbin/ns-slapd was killed by signal 11 (SIGSEGV)
• BZ - 833202 - transaction retries need to be cache aware
• BZ - 833218 - ldapmodify returns Operations error
• BZ - 833222 - memberOf attribute and plugin behaviour between sub-suffixes
• BZ - 834046 - [RFE] Add nsTLS1 attribute to schema and objectclass nsEncryptionConfig
• BZ - 834047 - Fine Grained Password policy: if passwordHistory is on, deleting the password fails.
• BZ - 834049 - [RFE] Add schema for DNA plugin
• BZ - 834052 - [RFE] limiting Directory Manager (nsslapd-rootdn) bind access by source host (e.g. 127.0.0.1)
• BZ - 834053 - [RFE] Plugins - ability to control behavior of modifyTimestamp/modifiersName
• BZ - 834054 - Should only update modifyTimestamp/modifiersName on MODIFY ops
• BZ - 834056 - Automembership plugin fails in a MMR setup, if data and config area mixed in the plugin configuration
• BZ - 834057 - ldap-agent crashes on start with signal SIGSEGV
• BZ - 834058 - [RFE] logconv.pl : use of getopts to parse commandline options
• BZ - 834060 - passwordMaxFailure should lockout password one sooner - and should be configurable to avoid regressions
• BZ - 834061 - [RFE] RHDS: Implement SO_KEEPALIVE in network calls.
• BZ - 834063 - [RFE] enable attribute that tracks when a password was last set on an entry in the LDAP store
• BZ - 834064 - dnaNextValue gets incremented even if the user addition fails
• BZ - 834065 - Adding Replication agreement should complain if required nsds5ReplicaCredentials not supplied
• BZ - 834074 - [RFE] Disable replication agreements
• BZ - 834075 - logconv.pl reporting unindexed search with different search base than shown in access logs
• BZ - 835238 - Account Usability Control Not Working
• BZ - 836386 - slapi_ldap_bind() doesn't check bind results
• BZ - 838706 - referint modrdn not working if case is different
• BZ - 840153 - Impossible to rename entry (modrdn) with Attribute Uniqueness plugin enabled
• BZ - 841600 - Referential integrity plug-in does not work when update interval is not zero
• BZ - 842437 - dna memleak reported by valgrind
• BZ - 842438 - Report during startup if nsslapd-cachememsize is too small
• BZ - 842440 - memberof performance enhancement
• BZ - 842441 - "Server is unwilling to perform" when running ldapmodify on nsds5ReplicaStripAttrs
• BZ - 847868 - [RFE] support posix schema for user and group sync
• BZ - 850683 - nsds5ReplicaEnabled can be set with any invalid values.
• BZ - 852087 - [RFE] add attribute nsslapd-readonly so we can reference it in acis
• BZ - 852088 - server to server ssl client auth broken with latest openldap
• BZ - 852202 - Ipa master system initiated more than a dozen simultaneous replication sessions, shut itself down and wiped out its db
• BZ - 852839 - variable dn should not be used in ldbm_back_delete
• BZ - 855438 - CLEANALLRUV task gets stuck on winsync replication agreement
• BZ - 860603 - CVE-2012-4450 389-ds-base: Change on SLAPI_MODRDN_NEWSUPERIOR is not evaluated in ACL (ACL rules bypass possible)
• BZ - 860772 - Change on SLAPI_MODRDN_NEWSUPERIOR is not evaluated in acl
• BZ - 863576 - Dirsrv deadlock locking up IPA
• BZ - 864594 - anonymous limits are being applied to directory manager
• BZ - 868841 - Newly created users with organizationalPerson objectClass fails to sync from AD to DS with missing attribute error
• BZ - 868853 - Winsync: DS error logs report wrong version of Windows AD when winsync is configured.
• BZ - 870158 - slapd entered to infinite loop during new index addition
• BZ - 870162 - Cannot abandon simple paged result search
• BZ - 875862 - crash in DNA if no dnamagicregen is specified
• BZ - 876694 - RedHat Directory Server crashes (segfaults) when moving ldap entry
• BZ - 878111 - ns-slapd segfaults if it cannot rename the logs
• BZ - 880305 - spec file missing dependencies for x86_64 6ComputeNode
• BZ - 887855 - RootDN Access Control plugin is missing after upgrade from RHEL63 to RHEL64
• BZ - 889083 - For modifiersName/internalModifiersName feature, internalModifiersname is not working for DNA plugin
• BZ - 891930 - DNA plugin no longer reports additional info when range is depleted
• BZ - 896256 - updating package touches configuration files

CVEs

• CVE-2012-4450

References

• https://access.redhat.com/knowledge/docs/en-US/Red_Hat_Enterprise_Linux/6/html/6.4_Technical_Notes/pkg-389-ds-base.html
• https://access.redhat.com/security/updates/classification/#moderate