Login
Newsletter
Werbung

Sicherheit: Denial of Service in 389-ds-base
Aktuelle Meldungen Distributionen
Name: Denial of Service in 389-ds-base
ID: FEDORA-2013-22012
Distribution: Fedora
Plattformen: Fedora 19
Datum: Di, 3. Dezember 2013, 12:36
Referenzen: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4485
Applikationen: 389-ds-base

Originalnachricht

Name        : 389-ds-base
Product : Fedora 19
Version : 1.3.1.16
Release : 1.fc19
URL : http://port389.org/
Summary : 389 Directory Server (base)
Description :
389 Directory Server is an LDAPv3 compliant server. The base package includes
the LDAP server and command line utilities for server administration.

-------------------------------------------------------------------------------
-
Update Information:

Fixes Ticket 47599 - Reduce lock scope in retro changelog plug-in - previous
fix missing defition of retrocl_cn_lock
-------------------------------------------------------------------------------
-
ChangeLog:

* Fri Nov 22 2013 Rich Megginson <rmeggins@redhat.com> - 1.3.1.16-1
- Ticket 47599 - Reduce lock scope in retro changelog plug-in
- Forgot to add definition of retrocl_cn_lock
* Thu Nov 21 2013 Rich Megginson <rmeggins@redhat.com> - 1.3.1.15-1
- Ticket #47605 CVE-2013-4485: DoS due to improper handling of ger attr searche
- Ticket 47599 - Reduce lock scope in retro changelog plug-in
- Ticket #47596 attrcrypt fails to find unlocked key
- Ticket 47598 - Convert ldbm_back_seq code to be transaction aware
- Ticket 47597 - Convert retro changelog plug-in to betxn
- Revert "Ticket #47559 hung server - related to sasl and initialize"
- Ticket #47585 Replication Failures related to skipped entries due to cleaned
rids
* Fri Nov 8 2013 Noriko Hosoi <nhosoi@redhat.com> - 1.3.1.14-1
- the 1.3.1.14 release - several bug fixes
- Ticket 47589 - Winsync replica initialization and incremental updates from DS
to AD fails on RHEL7
- Ticket 47588 - Compiler warnings building on F19
- Coverity (Part 7) + Jenkins fix
* Wed Nov 6 2013 Noriko Hosoi <nhosoi@redhat.com> - 1.3.1.13-1
- the 1.3.1.13 release - several bug fixes
- Ticket 47379 - DNA plugin failed to fetch replication agreement
- Ticket 47379 - DNA plugin failed to fetch replication agreement
- Ticket 47581 - Winsync plugin segfault during incremental backoff (phase 2)
- Ticket 47581 - Winsync plugin segfault during incremental backoff
- Ticket 47577 - crash when removing entries from cache
- Ticket 47560 - fixup memberof task does not work: task entry not added
- Ticket 47559 - hung server - related to sasl and initialize
- ticket 47550 - wip (cherry picked from commit
82377636267787be5182457d619d5a0b662d2658) (cherry picked from commit 181fde98aee96868189bc5557c5f33fefa026952)
- Coverity Fixes
- Ticket 47329 - Improve slapi_back_transaction_begin() return code when
transactions are not available
- Ticket 47550 - logconv: failed logins: Use of uninitialized value in numeric
comparison at logconv.pl line 949
* Thu Oct 10 2013 Noriko Hosoi <nhosoi@redhat.com> - 1.3.1.12-1
- release 1.3.1.12
- Ticket 47513 - tmpfiles.d references /var/lock when they should reference
/run/loc
- Ticket 47551 - logconv: -V does not produce unindexed search report
- Ticket 53 - Need to update supported locales
- Ticket 47517 - memory leak in range searches and other various leaks
- Ticket 53 - Need to update supported locales Cleaning up typos and format.
- Ticket 53 - Need to update supported locales
- Ticket 47522 - Password adminstrators should be able to voilate password
policy
- Ticket 54 - locale "nl" not supported by collation plugin
- Ticket 47543 - Mozldap - fix compiler warnings
- Coverity fixes - 12023, 12024, and 12025
- Ticket 47533 - logconv: some stats do not work across server restarts
- Ticket 47501 - logconv.pl uses /var/tmp for BDB temp files
- Ticket 47520 - Fix various issues with logconv.pl
- Ticket 47387 - improve logconv.pl performance with large access logs
- Ticket 47387 - improve logconv.pl performance with large access logs
- Ticket 47354 - Indexed search are logged with 'notes=U' in the access
logs
* Mon Sep 30 2013 Rich Megginson <rmeggins@redhat.com> - 1.3.1.11-1
- Ticket 47513 - Set localrundir outside of the "with-fhs" block
- Ticket 47513 - Refine the check for @localrundir@
- Ticket 47510 - remove unnecessary typedef
- Ticket 47510 - Repl Sync does not compile against MozLDAP libraries
* Fri Sep 27 2013 Rich Megginson <rmeggins@redhat.com> - 1.3.1.10-1
- Ticket #47534 - RUV tombstone search with scope "one" doesn`t work
- Ticket 47510 - 389-ds-base does not compile against MozLDAP libraries
- Ticket #47523 - Set up replcation/agreement before initializing the sub
suffix, the sub suffix is not found by ldapsearch
- Ticket 47528 - 389-ds-base built with mozldap can crash from invalid free
- Ticket #47504 idlistscanlimit per index/type/value
- Ticket 47513 - tmpfiles.d references /var/lock when they should reference
/run/lock
- Ticket #47492 - PassSync removes User must change password flag on the
Windows side
- Ticket 47509 - CLEANALLRUV doesnt run across all replicas
- Ticket #47516 replication stops with excessive clock skew
- 6829200 Coverity fix - 11952 - for Ticket 47512
- Ticket 47512 - backend txn plugin fixup tasks should be done in a txn
* Fri Sep 13 2013 Noriko Hosoi <nhosoi@redhat.com> - 1.3.1.9-1
- release 1.3.1.9
- Ticket 449 - Allow macro aci keywords to be case-insensitive
- Ticket 47489 - Under specific values of nsDS5ReplicaName, replication may get
broken or updates missing
- Ticket 47507 - automember rebuild task not working as expected
* Fri Sep 6 2013 Rich Megginson <rmeggins@redhat.com> - 1.3.1.8-1
- Ticket #47455 - valgrind - value mem leaks, uninit mem usage
- fix breakage in slapi-nis introduced with the previous fix
- Ticket 47500 - start-dirsrv/restart-dirsrv/stop-disrv do not register with
systemd correctly
* Wed Aug 28 2013 Noriko Hosoi <nhosoi@redhat.com> - 1.3.1.7-1
- bump version to 1.3.1.7
- Bug 1002215 - CVE-2013-4283 389-ds-base: ns-slapd crash due to bogus DN
- Ticket 47488 - Users from AD sub OU does not sync to IPA
- Ticket 47461 - logconv.pl - Use of comma-less variable list is deprecated
- Ticket 47473 - setup-ds.pl doesn't lookup the "root" group
correctly
* Thu Aug 1 2013 Noriko Hosoi <nhosoi@redhat.com> - 1.3.1.6-1
- bump version to 1.3.1.6
- Ticket 47455 - valgrind - value mem leaks, uninit mem usage
- fix coverity 11915 - dead code - introduced with fix for ticket 346
- fix coverity 11895 - null deref - caused by fix to ticket 47392
- fix compiler warning in posix winsync code for
posix_group_del_memberuid_callback
- Fix compiler warnings for Ticket 47395 and 47397
- fix compiler warning (cherry picked from commit
904416f4631d842a105851b4a9931ae17822a107)
- Ticket 47450 - Fix compiler formatting warning errors for 32/64 bit arch
- fix compiler warnings
- Fix compiler warning (cherry picked from commit
ec6ebc0b0f085a82041d993ab2450a3922ef5502)
* Wed Jul 31 2013 Noriko Hosoi <nhosoi@redhat.com> - 1.3.1.5-1
- bump version to 1.3.1.5
- Ticket 47456 - delete present values should append values to deleted values
- Ticket 47455 - valgrind - value mem leaks, uninit mem usage
- Ticket 47448 - Segfault in 389-ds-base-1.3.1.4-1.fc19 when setting up FreeIPA
replication
- Ticket 47440 - Fix runtime errors caused by last patch.
- Ticket 47440 - Fix compilation warnings and header files
- Ticket 47405 - CVE-2013-2219 ACLs inoperative in some search scenarios
- Ticket 47447 - logconv.pl man page missing -m,-M,-B,-D
- Ticket 47378 - fix recent compiler warnings
- Ticket 47427 - Overflow in nsslapd-disk-monitoring-threshold
- Ticket 47449 - deadlock after adding and deleting entries
- Ticket 47441 - Disk Monitoring not checking filesystem with logs
- Ticket 47427 - Overflow in nsslapd-disk-monitoring-threshold
* Fri Jul 19 2013 Noriko Hosoi <nhosoi@redhat.com> - 1.3.1.4-1
- bump version to 1.3.1.4
- Ticket 47435 - Very large entryusn values after enabling the USN plugin and
the lastusn value is negative.
- Ticket 47424 - Replication problem with add-delete requests on single-valued
attributes
- Ticket 47367 - (phase 2) ldapdelete returns non-leaf entry error while trying
to remove a leaf entry
- Ticket 47367 - (phase 1) ldapdelete returns non-leaf entry error while trying
to remove a leaf entry
- Ticket 47421 - memory leaks in set_krb5_creds
- Ticket 346 - version 4 Slow ldapmodify operation time for large quantities of
multi-valued attribute values
- Ticket 47369 version2 - provide default syntax plugin
- Ticket 47427 - Overflow in nsslapd-disk-monitoring-threshold
- Ticket 47399 - RHDS denies MODRDN access if ACI list contains any DENY rule
- Ticket 47427 - Overflow in nsslapd-disk-monitoring-threshold
- Ticket 47428 - Memory leak in 389-ds-base 1.2.11.15
- Ticket 47392 - ldbm errors when adding/modifying/deleting entries
- Ticket 47385 - Disk Monitoring is not triggered as expected.
- Ticket 47410 - changelog db deadlocks with DNA and replication
* Wed Jul 3 2013 Noriko Hosoi <nhosoi@redhat.com> - 1.3.1.3-1
- bump version to 1.3.1.3
- Ticket 47374 - flush.pl is not included in perl5
- Ticket 47391 - deleting and adding userpassword fails to update the password
(additional fix)
- Ticket 47393 - Attribute are not encrypted on a consumer after a full
initialization
- Ticket 47395 47397 - v2 correct behaviour of account policy if only stateattr
is configured or no alternate attr is configured
- Ticket 47396 - crash on modrdn of tombstone
- Ticket 47400 - MMR stress test with dna enabled causes a deadlock
- Ticket 47409 - allow setting db deadlock rejection policy
- Ticket 47419 - Unhashed userpassword can accidentally get removed from mods
- Ticket 47420 - An upgrade script 80upgradednformat.pl fails to handle a
server instance name incuding '-'
-------------------------------------------------------------------------------
-
References:

[ 1 ] Bug #1024552 - CVE-2013-4485 389-ds-base: DoS due to improper handling
of ger attr searches
https://bugzilla.redhat.com/show_bug.cgi?id=1024552
-------------------------------------------------------------------------------
-

This update can be installed with the "yum" update program. Use
su -c 'yum update 389-ds-base' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
-------------------------------------------------------------------------------
-
_______________________________________________
package-announce mailing list
package-announce@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/package-announce
Pro-Linux
Gewinnspiel
Neue Nachrichten
Werbung