The acllas__handle_group_entry function in servers/plugins/acl/acllas.c in 389 Directory Server before 1.2.10 does not properly handled access control instructions (ACIs) that use certificate groups, which allows remote authenticated LDAP users with a certificate group to cause a denial of service (infinite loop and CPU consumption) by binding to the server.

Updated Red Hat Directory Server and related packages that fix one security issue and multiple bugs are now available for Red Hat Directory Server 8.2.

The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The redhat-ds-base packages provide Red Hat Directory Server, which is an LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

A flaw was found in the way the 389 Directory Server daemon (ns-slapd) handled access control instructions (ACIs) using certificate groups.
If an LDAP user that had a certificate group defined attempted to bind to the directory server, it would cause ns-slapd to enter an infinite loop and consume an excessive amount of CPU time. (CVE-2012-0833)

Red Hat would like to thank Graham Leggett for reporting this issue.

This update also fixes the following bugs :

* Search with a complex filter that included a range search filter was slow. (BZ#853004)

* If the server was restarted, or there was some type of connection failure, it was possible that users were no longer able to log into the console. Manual action is required to apply this fix: You must add an aci to each 'cn=Server Group' entry in 'o=netscaperoot', that allows anonymous/all users read/search rights. (BZ#856089)

* With replication enabled, trying to replace an existing value, where the new value only differs in case (for example, changing 'cn: foo' to 'cn: FOO'), resulted in the operation failing with an error 20.
(BZ#891866)

All users of Red Hat Directory Server 8.2 should upgrade to these updated packages, which resolve these issues.

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2012-0813 advisory.

    [1.2.10.2-15]
    - Resolves: Bug 824014 - DS Shuts down intermittently

    [1.2.10.2-14]
    - Resolves: Bug 819643 - Database RUV could mismatch the one in changelog under the stress
    -- patch 0015 fixes a small memleak in previous patch

    [1.2.10.2-13]
    - Resolves: Bug 822700 - Bad DNs in ACIs can segfault ns-slapd

    [1.2.10.2-12]
    - Resolves: Bug 819643 - Database RUV could mismatch the one in changelog under the stress
    - Resolves: Bug 821542 - letters in object's cn get converted to lowercase when renaming object

    [1.2.10.2-11]
    - Resolves: Bug 819643 - Database RUV could mismatch the one in changelog under the stress
    - 1.2.10.2-10 was built from the private branch

    [1.2.10.2-10]
    - Resolves: Bug 819643 - Database RUV could mismatch the one in changelog under the stress

    [1.2.10.2-9]
    - Resolves: Bug 815991 - crash in ldap_initialize with multiple threads
    -  previous fix was still crashing in ldclt

    [1.2.10.2-8]
    - Resolves: Bug 815991 - crash in ldap_initialize with multiple threads

    [1.2.10.2-7]
    - Resolves: Bug 813964 - IPA dirsvr seg-fault during system longevity test

    [1.2.10.2-6]
    - Resolves: Bug 811291 - [abrt] 389-ds-base-1.2.10.4-2.fc16: index_range_read_ext: Process /usr/sbin/ns-     slapd was killed by signal 11 (SIGSEGV)
    - typo in previous patch

    [1.2.10.2-5]
    - Resolves: Bug 811291 - [abrt] 389-ds-base-1.2.10.4-2.fc16: index_range_read_ext: Process /usr/sbin/ns-     slapd was killed by signal 11 (SIGSEGV)

    [1.2.10.2-4]
    - Resolves: Bug 803930 - ipa not starting after upgade because of missing data
    - get rid of posttrans - move update code to post

    [1.2.10.2-3]
    - Resolves: Bug 800215 - Certain CMP operations hang or cause ns-slapd to crash

    [1.2.10.2-2]
    - Resolves: Bug 800215 - Certain CMP operations hang or cause ns-slapd to crash
    - Resolves: Bug 800217 - fix valgrind reported issues

    [1.2.10.2-1]
    - Resolves: Bug 766989 - Rebase 389-ds-base to 1.2.10
    - Resolves: Bug 796770 - crash when replicating orphaned tombstone entry

    [1.2.10.1-1]
    - Resolves: Bug 766989 - Rebase 389-ds-base to 1.2.10
    - Resolves: Bug 790491 - 389 DS Segfaults during replica install in FreeIPA

    [1.2.10.0-1]
    - Resolves: Bug 766989 - Rebase 389-ds-base to 1.2.10

    [1.2.10-0.11.rc2]
    - Resolves: Bug 766989 - Rebase 389-ds-base to 1.2.10

    [1.2.9.16-1]
    - Bug 759301 - Incorrect entryUSN index under high load in replicated environment
    - Bug 743979 - Add slapi_rwlock API and use POSIX rwlocks
    - WARNING - patches 0030 and 0031 remove and add back the file configure
    - this is necessary because the merge commit to rebase RHEL-6 to 1.2.9.6
    - seriously messed up configure - so in order to add the patch for 743979
    - which also touched configure, the file had to be removed and added back
    - also note that the commit for the RHEL-6 branch to remove configure does
    - not work - the way patch works, it has to match every line exactly in
    - order to remove the file, and because the merge commit messed things
    - up, it doesn't work
    - So, DO NOT TOUCH 0030-remove-configure-to-get-rid-of-merge-conflict.patch
    - BECAUSE IT IS HAND CRAFTED and not generated by git format-patch
    - if you must regenerate this file,
    - git format-patch ...args... to generate a file in patch format
    - remove all of the patch matches (all the lines beginning with -)
    - get the 1.2.9.6 version of configure from the source tarball
    - wc -l configure to get the number of lines in the file
    - sed 's/^/-/' configure >> thefile.patch
    - edit thefile.patch to have the right number of lines and have the
    - patch commands in the correct place
    - PROFIT!!!

    [1.2.9.15-1]
    - Bug 752577 - crash when simple paged fails to send entry to client
    - Bug 757897 - rhds81 modrn operation and 100% cpu use in replication
    - Bug 757898 - Fix Coverity (11104) Resource leak: ids_sasl_user_to_entry (slapd/saslbind.c)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Apache HTTP SERVER PROJECT reports:low: XSS in mod_negotiation when untrusted uploads are supported CVE-2012-2687 Possible XSS for sites which use mod_negotiation and allow untrusted uploads to locations which have MultiViews enabled. low: insecure LD_LIBRARY_PATH handling CVE-2012-0883 This issue was already fixed in port version 2.2.22_5

The 389 Directory Server is an LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

A flaw was found in the way the 389 Directory Server daemon (ns-slapd) handled access control instructions (ACIs) using certificate groups.
If an LDAP user that had a certificate group defined attempted to bind to the directory server, it would cause ns-slapd to enter an infinite loop and consume an excessive amount of CPU time. (CVE-2012-0833)

These updated 389-ds-base packages also include numerous bug fixes and enhancements.

Users are advised to upgrade to these updated 389-ds-base packages, which resolve these issues and add these enhancements. After installing this update, the 389 server service will be restarted automatically.

Updated 389-ds-base packages that fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The 389 Directory Server is an LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

A flaw was found in the way the 389 Directory Server daemon (ns-slapd) handled access control instructions (ACIs) using certificate groups.
If an LDAP user that had a certificate group defined attempted to bind to the directory server, it would cause ns-slapd to enter an infinite loop and consume an excessive amount of CPU time. (CVE-2012-0833)

Red Hat would like to thank Graham Leggett for reporting this issue.

These updated 389-ds-base packages also include numerous bug fixes and enhancements. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Enterprise Linux 6.3 Technical Notes for information on the most significant of these changes.

Users are advised to upgrade to these updated 389-ds-base packages, which resolve these issues and add these enhancements. After installing this update, the 389 server service will be restarted automatically.

ID	Name	Product	Family	Severity
78949	RHEL 5 : Red Hat Directory Server (RHSA-2013:0549)	Nessus	Red Hat Local Security Checks	low
68552	Oracle Linux 6 : 389-ds-base (ELSA-2012-0813)	Nessus	Oracle Linux Local Security Checks	high
62806	FreeBSD : apache22 -- several vulnerabilities (65539c54-2517-11e2-b9d6-20cf30e32f6d)	Nessus	FreeBSD Local Security Checks	low
61335	Scientific Linux Security Update : 389-ds-base on SL6.x i386/x86_64 (20120620)	Nessus	Scientific Linux Local Security Checks	low
59923	CentOS 6 : 389-ds-base (CESA-2012:0813)	Nessus	CentOS Local Security Checks	low
59588	RHEL 6 : 389-ds-base (RHSA-2012:0813)	Nessus	Red Hat Local Security Checks	low

Detections

Analytics

CVE-2012-0833

medium

Tenable Plugins

low

high

low

low

low

low