advisories/10138.adv

type: security
subject: Updated 389-ds-base packag fixes security vulnerabilies and incorrect group usage
CVE:
 - CVE-2013-2219
 - CVE-2013-4283
src:
  3:
   core:
     - 389-ds-base-1.3.0.5-2.3.mga3
description: |
  Updated 389-ds-base packages fix security vulnerabilities:

  It was discovered that the 389 Directory Server did not honor defined
  attribute access controls when evaluating search filter expressions. A
  remote attacker (with permission to query the Directory Server) could use
  this flaw to determine the values of restricted attributes via a series of
  search queries with filter conditions that used restricted attributes
  (CVE-2013-2219).

  It was discovered that the 389 Directory Server did not properly handle the
  receipt of certain MOD operations with a bogus Distinguished Name (DN). A
  remote, unauthenticated attacker could use this flaw to cause the 389
  Directory Server to crash (CVE-2013-4283).

  Additionally, problems of wrong default group nobody (from upstream) as well
  as the 389-ds server not starting after a reboot have been fixed (mga#10138).
references:
 - https://bugs.mageia.org/show_bug.cgi?id=10138
 - https://bugs.mageia.org/show_bug.cgi?id=10889
 - https://rhn.redhat.com/errata/RHSA-2013-1119.html
 - https://rhn.redhat.com/errata/RHSA-2013-1182.html
1	davidwhodgins	336	type: security
2	claire	388	subject: Updated 389-ds-base packag fixes security vulnerabilies and incorrect group usage
3	davidwhodgins	336	CVE:
4			- CVE-2013-2219
5	claire	388	- CVE-2013-4283
6	davidwhodgins	336	src:
7			3:
8			core:
9	davidwhodgins	348	- 389-ds-base-1.3.0.5-2.3.mga3
10	davidwhodgins	336	description: \|
11	claire	388	Updated 389-ds-base packages fix security vulnerabilities:
12
13	davidwhodgins	336	It was discovered that the 389 Directory Server did not honor defined
14			attribute access controls when evaluating search filter expressions. A
15			remote attacker (with permission to query the Directory Server) could use
16			this flaw to determine the values of restricted attributes via a series of
17			search queries with filter conditions that used restricted attributes
18			(CVE-2013-2219).
19
20	claire	388	It was discovered that the 389 Directory Server did not properly handle the
21			receipt of certain MOD operations with a bogus Distinguished Name (DN). A
22			remote, unauthenticated attacker could use this flaw to cause the 389
23			Directory Server to crash (CVE-2013-4283).
24
25	davidwhodgins	336	Additionally, problems of wrong default group nobody (from upstream) as well
26			as the 389-ds server not starting after a reboot have been fixed (mga#10138).
27			references:
28			- https://bugs.mageia.org/show_bug.cgi?id=10138
29			- https://bugs.mageia.org/show_bug.cgi?id=10889
30			- https://rhn.redhat.com/errata/RHSA-2013-1119.html
31	claire	388	- https://rhn.redhat.com/errata/RHSA-2013-1182.html