drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Pufferüberlauf in nss-pam-ldapd
Name: |
Pufferüberlauf in nss-pam-ldapd |
|
ID: |
MDVSA-2013:106 |
|
Distribution: |
Mandriva |
|
Plattformen: |
Mandriva Business Server 1.0 |
|
Datum: |
Mi, 10. April 2013, 14:42 |
|
Referenzen: |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0288
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0071 |
|
Applikationen: |
nss-pam-ldapd |
|
Originalnachricht |
This is a multi-part message in MIME format...
------------=_1365593230-2161-374
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2013:106 http://www.mandriva.com/en/support/security/ _______________________________________________________________________
Package : nss-pam-ldapd Date : April 10, 2013 Affected: Business Server 1.0 _______________________________________________________________________
Problem Description:
Updated nss-pam-ldapd packages fixes the following security vulnerability: Garth Mollett discovered that a file descriptor overflow issue in the use of FD_SET() in nss-pam-ldapd can lead to a stack-based buffer overflow. An attacker could, under some circumstances, use this flaw to cause a process that has the NSS or PAM module loaded to crash or potentially execute arbitrary code. The issue can be triggered in a network daemon by opening a large number of connections and forcing a name lookup. This would result in a crash and possibly remote code execution. This issue may also allow local privilege escalation if a suid program does name lookups and doesn't close file descriptors inherited from the parent process (CVE-2013-0288). _______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0288 https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0071 _______________________________________________________________________
Updated Packages:
Mandriva Business Server 1/X86_64: cbf543dd3fef9f555cff3437e2a38639 mbs1/x86_64/nss-pam-ldapd-0.8.6-4.1.mbs1.x86_64.rpm 4e6bf408943ff751ed7655b661bec550 mbs1/SRPMS/nss-pam-ldapd-0.8.6-4.1.mbs1.src.rpm _______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/en/support/security/advisories/
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com _______________________________________________________________________
Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux)
iD8DBQFRZSHrmqjQ0CJFipgRAgbfAKCSr8sXuhi6fqHiGAPnN1bsPifwpwCfSfpy bdicQKUhJy3d51gHAEHQZHA= =tafI -----END PGP SIGNATURE-----
------------=_1365593230-2161-374 Content-Type: text/plain; charset="UTF-8"; name="message-footer.txt" Content-Disposition: inline; filename="message-footer.txt" Content-Transfer-Encoding: 8bit
To unsubscribe, send a email to sympa@mandrivalinux.org with this subject : unsubscribe security-announce _______________________________________________________ Want to buy your Pack or Services from Mandriva? Go to http://store.mandriva.com _______________________________________________________
------------=_1365593230-2161-374--
|
|
|
|