Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
(AV:N/AC:M/Au:N/C:P/I:N/A:N)
Производитель ПО
Наименование ПО
nss_ldap
(Unknown)
Описание
Условия race condition в nss_ldap при использовании в приложениях, которые собраны с библиотекой pthread и fork после вызова nss_ldap, позволяют отправлять пользовательские данные другому процессу из-за некорректной обработки LDAP-подключений.
Как исправить
Для устранения уязвимости необходимо установить последнюю версию продукта, соответствующую используемой платформе. Необходимую информацию можно получить по адресу:
http://www.padl.com/OSS/nss_ldap.html
http://www.padl.com/OSS/nss_ldap.html
Ссылки
BID (26452): http://www.securityfocus.com/bid/26452
CONFIRM (https://issues.rpath.com/browse/RPL-1913): https://issues.rpath.com/browse/RPL-1913
CONFIRM (https://bugzilla.redhat.com/show_bug.cgi?id=367461): https://bugzilla.redhat.com/show_bug.cgi?id=367461
CONFIRM (https://bugzilla.redhat.com/show_bug.cgi?id=154314): https://bugzilla.redhat.com/show_bug.cgi?id=154314
XF (nssldap-ldap-race-condition(38505)): http://xforce.iss.net/xforce/xfdb/38505
SECTRACK (1020088): http://www.securitytracker.com/id?1020088
BUGTRAQ (20080212 FLEA-2008-0003-1 nss_ldap): http://www.securityfocus.com/archive/1/archive/1/487985/100/0/threaded
REDHAT (RHSA-2008:0715): http://www.redhat.com/support/errata/RHSA-2008-0715.html
REDHAT (RHSA-2008:0389): http://www.redhat.com/support/errata/RHSA-2008-0389.html
MANDRIVA (MDVSA-2008:049): http://www.mandriva.com/security/advisories?name=MDVSA-2008:049
MLIST ([Dovecot] 20050303 hanging imap... and users getting other users' emails!): http://www.dovecot.org/list/dovecot/2005-March/006345.html
MLIST ([Dovecot] 20050409 Authentication and the wrong mailbox?): http://www.dovecot.org/list/dovecot/2005-April/006859.html
DEBIAN (DSA-1430): http://www.debian.org/security/2007/dsa-1430
CONFIRM (http://wiki.rpath.com/wiki/Advisories:rPSA-2007-0255): http://wiki.rpath.com/wiki/Advisories:rPSA-2007-0255
CONFIRM (http://support.avaya.com/elmodocs2/security/ASA-2008-332.htm): http://support.avaya.com/elmodocs2/security/ASA-2008-332.htm
GENTOO (GLSA-200711-33): http://security.gentoo.org/glsa/glsa-200711-33.xml
SUSE (SUSE-SR:2008:003): http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00003.html
CONFIRM (http://bugs.gentoo.org/show_bug.cgi?id=198390): http://bugs.gentoo.org/show_bug.cgi?id=198390
CONFIRM (http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=453868): http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=453868
CONFIRM (https://issues.rpath.com/browse/RPL-1913): https://issues.rpath.com/browse/RPL-1913
CONFIRM (https://bugzilla.redhat.com/show_bug.cgi?id=367461): https://bugzilla.redhat.com/show_bug.cgi?id=367461
CONFIRM (https://bugzilla.redhat.com/show_bug.cgi?id=154314): https://bugzilla.redhat.com/show_bug.cgi?id=154314
XF (nssldap-ldap-race-condition(38505)): http://xforce.iss.net/xforce/xfdb/38505
SECTRACK (1020088): http://www.securitytracker.com/id?1020088
BUGTRAQ (20080212 FLEA-2008-0003-1 nss_ldap): http://www.securityfocus.com/archive/1/archive/1/487985/100/0/threaded
REDHAT (RHSA-2008:0715): http://www.redhat.com/support/errata/RHSA-2008-0715.html
REDHAT (RHSA-2008:0389): http://www.redhat.com/support/errata/RHSA-2008-0389.html
MANDRIVA (MDVSA-2008:049): http://www.mandriva.com/security/advisories?name=MDVSA-2008:049
MLIST ([Dovecot] 20050303 hanging imap... and users getting other users' emails!): http://www.dovecot.org/list/dovecot/2005-March/006345.html
MLIST ([Dovecot] 20050409 Authentication and the wrong mailbox?): http://www.dovecot.org/list/dovecot/2005-April/006859.html
DEBIAN (DSA-1430): http://www.debian.org/security/2007/dsa-1430
CONFIRM (http://wiki.rpath.com/wiki/Advisories:rPSA-2007-0255): http://wiki.rpath.com/wiki/Advisories:rPSA-2007-0255
CONFIRM (http://support.avaya.com/elmodocs2/security/ASA-2008-332.htm): http://support.avaya.com/elmodocs2/security/ASA-2008-332.htm
GENTOO (GLSA-200711-33): http://security.gentoo.org/glsa/glsa-200711-33.xml
SUSE (SUSE-SR:2008:003): http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00003.html
CONFIRM (http://bugs.gentoo.org/show_bug.cgi?id=198390): http://bugs.gentoo.org/show_bug.cgi?id=198390
CONFIRM (http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=453868): http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=453868
