nss security update

CentOS Errata and Security Advisory CESA-2013:0590

The nss-pam-ldapd packages provide the nss-pam-ldapd daemon (nslcd), which
uses a directory server to lookup name service information on behalf of a
lightweight nsswitch module.

An array index error, leading to a stack-based buffer overflow flaw, was
found in the way nss-pam-ldapd managed open file descriptors. An attacker
able to make a process have a large number of open file descriptors and
perform name lookups could use this flaw to cause the process to crash or,
potentially, execute arbitrary code with the privileges of the user running
the process. (CVE-2013-0288)

Red Hat would like to thank Garth Mollett for reporting this issue.

All users of nss-pam-ldapd are advised to upgrade to these updated
packages, which contain a backported patch to fix this issue.

Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2013-March/081790.html
https://lists.centos.org/pipermail/centos-cr-announce/2013-March/027086.html

Affected packages:
nss-pam-ldapd

Upstream details at:
https://access.redhat.com/errata/RHSA-2013:0590