1 |
type: security |
2 |
subject: Updated 389-ds-base packag fixes security vulnerabilies and incorrect group usage |
3 |
CVE: |
4 |
- CVE-2013-2219 |
5 |
- CVE-2013-4283 |
6 |
src: |
7 |
3: |
8 |
core: |
9 |
- 389-ds-base-1.3.0.5-2.3.mga3 |
10 |
description: | |
11 |
Updated 389-ds-base packages fix security vulnerabilities: |
12 |
|
13 |
It was discovered that the 389 Directory Server did not honor defined |
14 |
attribute access controls when evaluating search filter expressions. A |
15 |
remote attacker (with permission to query the Directory Server) could use |
16 |
this flaw to determine the values of restricted attributes via a series of |
17 |
search queries with filter conditions that used restricted attributes |
18 |
(CVE-2013-2219). |
19 |
|
20 |
It was discovered that the 389 Directory Server did not properly handle the |
21 |
receipt of certain MOD operations with a bogus Distinguished Name (DN). A |
22 |
remote, unauthenticated attacker could use this flaw to cause the 389 |
23 |
Directory Server to crash (CVE-2013-4283). |
24 |
|
25 |
Additionally, problems of wrong default group nobody (from upstream) as well |
26 |
as the 389-ds server not starting after a reboot have been fixed (mga#10138). |
27 |
references: |
28 |
- https://bugs.mageia.org/show_bug.cgi?id=10138 |
29 |
- https://bugs.mageia.org/show_bug.cgi?id=10889 |
30 |
- https://rhn.redhat.com/errata/RHSA-2013-1119.html |
31 |
- https://rhn.redhat.com/errata/RHSA-2013-1182.html |