Gentoo Archives: gentoo-announce

From: Daniel Ahlberg <aliz@g.o>
To: gentoo-announce@g.o
Subject: [gentoo-announce] GLSA: nss_ldap
Date: Sun, 13 Oct 2002 07:39:34
Message-Id: 20021013123932.DB6FE336F6@mail1.tamperd.net
1 -----BEGIN PGP SIGNED MESSAGE-----
2 Hash: SHA1
3
4 - - --------------------------------------------------------------------
5 GENTOO LINUX SECURITY ANNOUNCEMENT
6 - - --------------------------------------------------------------------
7
8 PACKAGE        :nss_ldap
9 SUMMARY        :Buffer overflow
10 DATE           :2002-10-13 12:45 UTC
11
12 - - --------------------------------------------------------------------
13
14 Buffer overflow in the DNS SRV code for nss_ldap before nss_ldap-198
15 allows remote attackers to cause a denial of service and possibly
16 execute arbitrary code.
17
18 DETAIL
19
20 When versions of nss_ldap prior to nss_ldap-198 are configured
21 without a value for the "host" setting, nss_ldap will attempt to
22 configure itself by using SRV records stored in DNS. When parsing the
23 results of the DNS query, nss_ldap does not check that the data
24 returned by the server willfit into an internal buffer, leaving it
25 vulnerable to a buffer overflow. The Common Vulnerabilities and
26 Exposures project (cve.mitre.org) has assigned the name CAN-2002-0825
27 to this issue.
28
29 When versions of nss_ldap prior to nss_ldap-199 are configured
30 without a value for the "host" setting, nss_ldap will attempt to
31 configure itself by using SRV records stored in DNS. When parsing
32 the results of the DNS query, nss_ldap does not check that the data
33 returned has not been truncated by the resolver libraries to avoid a
34 buffer overflow, and may attempt to parse more data than is actually
35 available, leaving it vulnerable to a read buffer overflow.
36
37 SOLUTION
38
39 It is recommended that all Gentoo Linux users who are running
40 net-libs/nss_ldap-174-r2 and earlier update their systems
41 as follows:
42
43 emerge rsync
44 emerge nss_ldap
45 emerge clean
46
47 - - --------------------------------------------------------------------
48 aliz@g.o - GnuPG key is available at www.gentoo.org/~aliz
49 - - --------------------------------------------------------------------
50 -----BEGIN PGP SIGNATURE-----
51 Version: GnuPG v1.0.7 (GNU/Linux)
52
53 iD8DBQE9qWqGfT7nyhUpoZMRAl5/AJ9OguSgjT472Jc3wPhXSBZA8k8YcwCeMNDj
54 ZEvGURfhv4eJwk0ZYFUiCWo=
55 =7SpP
56 -----END PGP SIGNATURE-----