compat, openldap security update

2007-11-1519:22:48

CentOS Project

lists.centos.org

CVSS2

7.1

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:N/I:N/A:C

EPSS

0.038

Percentile

92.0%

JSON

CentOS Errata and Security Advisory CESA-2007:1038

OpenLDAP is an open source suite of LDAP (Lightweight Directory Access
Protocol) applications and development tools.

A flaw was found in the way OpenLDAP’s slapd daemon handled malformed
objectClasses LDAP attributes. An authenticated local or remote attacker
could create an LDAP request which could cause a denial of service by
crashing slapd. (CVE-2007-5707)

In addition, the following feature was added:

OpenLDAP client tools now have new option to configure their bind timeout.

All users are advised to upgrade to these updated openldap packages, which
contain a backported patch to correct this issue and provide this security
enhancement.

Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2007-November/076594.html
https://lists.centos.org/pipermail/centos-announce/2007-November/076611.html

Affected packages:
compat-openldap
openldap
openldap-clients
openldap-devel
openldap-servers
openldap-servers-sql

Upstream details at:
https://access.redhat.com/errata/RHSA-2007:1038

OSVersionArchitecturePackageVersionFilename
CentOS4ia64compat-openldap< 2.1.30-8.c4.1compat-openldap-2.1.30-8.c4.1.ia64.rpm
CentOS4ia64openldap< 2.2.13-8.c4.1openldap-2.2.13-8.c4.1.ia64.rpm
CentOS4ia64openldap-clients< 2.2.13-8.c4.1openldap-clients-2.2.13-8.c4.1.ia64.rpm
CentOS4ia64openldap-devel< 2.2.13-8.c4.1openldap-devel-2.2.13-8.c4.1.ia64.rpm
CentOS4ia64openldap-servers< 2.2.13-8.c4.1openldap-servers-2.2.13-8.c4.1.ia64.rpm
CentOS4ia64openldap-servers-sql< 2.2.13-8.c4.1openldap-servers-sql-2.2.13-8.c4.1.ia64.rpm
CentOS4s390compat-openldap< 2.1.30-8.c4.1compat-openldap-2.1.30-8.c4.1.s390.rpm
CentOS4s390openldap< 2.2.13-8.c4.1openldap-2.2.13-8.c4.1.s390.rpm
CentOS4s390openldap-clients< 2.2.13-8.c4.1openldap-clients-2.2.13-8.c4.1.s390.rpm
CentOS4s390openldap-devel< 2.2.13-8.c4.1openldap-devel-2.2.13-8.c4.1.s390.rpm

OS	Version	Architecture	Package	Version	Filename
CentOS	4	ia64	compat-openldap	< 2.1.30-8.c4.1	compat-openldap-2.1.30-8.c4.1.ia64.rpm
CentOS	4	ia64	openldap	< 2.2.13-8.c4.1	openldap-2.2.13-8.c4.1.ia64.rpm
CentOS	4	ia64	openldap-clients	< 2.2.13-8.c4.1	openldap-clients-2.2.13-8.c4.1.ia64.rpm
CentOS	4	ia64	openldap-devel	< 2.2.13-8.c4.1	openldap-devel-2.2.13-8.c4.1.ia64.rpm
CentOS	4	ia64	openldap-servers	< 2.2.13-8.c4.1	openldap-servers-2.2.13-8.c4.1.ia64.rpm
CentOS	4	ia64	openldap-servers-sql	< 2.2.13-8.c4.1	openldap-servers-sql-2.2.13-8.c4.1.ia64.rpm
CentOS	4	s390	compat-openldap	< 2.1.30-8.c4.1	compat-openldap-2.1.30-8.c4.1.s390.rpm
CentOS	4	s390	openldap	< 2.2.13-8.c4.1	openldap-2.2.13-8.c4.1.s390.rpm
CentOS	4	s390	openldap-clients	< 2.2.13-8.c4.1	openldap-clients-2.2.13-8.c4.1.s390.rpm
CentOS	4	s390	openldap-devel	< 2.2.13-8.c4.1	openldap-devel-2.2.13-8.c4.1.s390.rpm