Alerta de Segurança Debian

DSA-227-1 openldap2 -- buffer overflows e outras falhas

Data do Alerta:
13 Jan 2003
Pacotes Afetados:
openldap2
Vulnerável:
Sim
Referência à base de dados de segurança:
Na base de dados do BugTraq (na SecurityFocus): ID BugTraq 6328, ID BugTraq 6620.
No dicionário CVE do Mitre: CVE-2002-1378, CVE-2002-1379, CVE-2002-1508.
Informações adicionais:

O Time de Segurança da SuSE revisou partes críticas do openldap2, uma implementação do LDAP (Lightweight Directory Access Protocol) versões 2 e 3, e encontrou vários buffer overflows e outros bugs que atacantes remotos poderiam explorar para obter acesso em sistemas que executem servidores LDAP vulneráveis. Além disso, vários bugs que podem ser explorados localmente nas bibliotecas OpenLDAP2 foram corrigidos.

Na distribuição estável (woody), estes problemas foram corrigidos na versão 2.0.23-6.3.

A antiga distribuição estável (potato) não contém pacotes OpenLDAP2.

Na distribuição instável (sid), estes problemas foram corrigidos na versão 2.0.27-3.

Nós recomendamos que você atualize seus pacotes openldap2.

Corrigido em:

Debian GNU/Linux 3.0 (woody)

Fonte:
http://security.debian.org/pool/updates/main/o/openldap2/openldap2_2.0.23-6.3.dsc
http://security.debian.org/pool/updates/main/o/openldap2/openldap2_2.0.23-6.3.diff.gz
http://security.debian.org/pool/updates/main/o/openldap2/openldap2_2.0.23.orig.tar.gz
Alpha:
http://security.debian.org/pool/updates/main/o/openldap2/ldap-gateways_2.0.23-6.3_alpha.deb
http://security.debian.org/pool/updates/main/o/openldap2/ldap-utils_2.0.23-6.3_alpha.deb
http://security.debian.org/pool/updates/main/o/openldap2/libldap2_2.0.23-6.3_alpha.deb
http://security.debian.org/pool/updates/main/o/openldap2/libldap2-dev_2.0.23-6.3_alpha.deb
http://security.debian.org/pool/updates/main/o/openldap2/slapd_2.0.23-6.3_alpha.deb
ARM:
http://security.debian.org/pool/updates/main/o/openldap2/ldap-gateways_2.0.23-6.3_arm.deb
http://security.debian.org/pool/updates/main/o/openldap2/ldap-utils_2.0.23-6.3_arm.deb
http://security.debian.org/pool/updates/main/o/openldap2/libldap2_2.0.23-6.3_arm.deb
http://security.debian.org/pool/updates/main/o/openldap2/libldap2-dev_2.0.23-6.3_arm.deb
http://security.debian.org/pool/updates/main/o/openldap2/slapd_2.0.23-6.3_arm.deb
Intel IA-32:
http://security.debian.org/pool/updates/main/o/openldap2/ldap-gateways_2.0.23-6.3_i386.deb
http://security.debian.org/pool/updates/main/o/openldap2/ldap-utils_2.0.23-6.3_i386.deb
http://security.debian.org/pool/updates/main/o/openldap2/libldap2_2.0.23-6.3_i386.deb
http://security.debian.org/pool/updates/main/o/openldap2/libldap2-dev_2.0.23-6.3_i386.deb
http://security.debian.org/pool/updates/main/o/openldap2/slapd_2.0.23-6.3_i386.deb
Intel IA-64:
http://security.debian.org/pool/updates/main/o/openldap2/ldap-gateways_2.0.23-6.3_ia64.deb
http://security.debian.org/pool/updates/main/o/openldap2/ldap-utils_2.0.23-6.3_ia64.deb
http://security.debian.org/pool/updates/main/o/openldap2/libldap2_2.0.23-6.3_ia64.deb
http://security.debian.org/pool/updates/main/o/openldap2/libldap2-dev_2.0.23-6.3_ia64.deb
http://security.debian.org/pool/updates/main/o/openldap2/slapd_2.0.23-6.3_ia64.deb
HPPA:
http://security.debian.org/pool/updates/main/o/openldap2/ldap-gateways_2.0.23-6.3_hppa.deb
http://security.debian.org/pool/updates/main/o/openldap2/ldap-utils_2.0.23-6.3_hppa.deb
http://security.debian.org/pool/updates/main/o/openldap2/libldap2_2.0.23-6.3_hppa.deb
http://security.debian.org/pool/updates/main/o/openldap2/libldap2-dev_2.0.23-6.3_hppa.deb
http://security.debian.org/pool/updates/main/o/openldap2/slapd_2.0.23-6.3_hppa.deb
Motorola 680x0:
http://security.debian.org/pool/updates/main/o/openldap2/ldap-gateways_2.0.23-6.3_m68k.deb
http://security.debian.org/pool/updates/main/o/openldap2/ldap-utils_2.0.23-6.3_m68k.deb
http://security.debian.org/pool/updates/main/o/openldap2/libldap2_2.0.23-6.3_m68k.deb
http://security.debian.org/pool/updates/main/o/openldap2/libldap2-dev_2.0.23-6.3_m68k.deb
http://security.debian.org/pool/updates/main/o/openldap2/slapd_2.0.23-6.3_m68k.deb
Big endian MIPS:
http://security.debian.org/pool/updates/main/o/openldap2/ldap-gateways_2.0.23-6.3_mips.deb
http://security.debian.org/pool/updates/main/o/openldap2/ldap-utils_2.0.23-6.3_mips.deb
http://security.debian.org/pool/updates/main/o/openldap2/libldap2_2.0.23-6.3_mips.deb
http://security.debian.org/pool/updates/main/o/openldap2/libldap2-dev_2.0.23-6.3_mips.deb
http://security.debian.org/pool/updates/main/o/openldap2/slapd_2.0.23-6.3_mips.deb
Little endian MIPS:
http://security.debian.org/pool/updates/main/o/openldap2/ldap-gateways_2.0.23-6.3_mipsel.deb
http://security.debian.org/pool/updates/main/o/openldap2/ldap-utils_2.0.23-6.3_mipsel.deb
http://security.debian.org/pool/updates/main/o/openldap2/libldap2_2.0.23-6.3_mipsel.deb
http://security.debian.org/pool/updates/main/o/openldap2/libldap2-dev_2.0.23-6.3_mipsel.deb
http://security.debian.org/pool/updates/main/o/openldap2/slapd_2.0.23-6.3_mipsel.deb
PowerPC:
http://security.debian.org/pool/updates/main/o/openldap2/ldap-gateways_2.0.23-6.3_powerpc.deb
http://security.debian.org/pool/updates/main/o/openldap2/ldap-utils_2.0.23-6.3_powerpc.deb
http://security.debian.org/pool/updates/main/o/openldap2/libldap2_2.0.23-6.3_powerpc.deb
http://security.debian.org/pool/updates/main/o/openldap2/libldap2-dev_2.0.23-6.3_powerpc.deb
http://security.debian.org/pool/updates/main/o/openldap2/slapd_2.0.23-6.3_powerpc.deb
IBM S/390:
http://security.debian.org/pool/updates/main/o/openldap2/ldap-gateways_2.0.23-6.3_s390.deb
http://security.debian.org/pool/updates/main/o/openldap2/ldap-utils_2.0.23-6.3_s390.deb
http://security.debian.org/pool/updates/main/o/openldap2/libldap2_2.0.23-6.3_s390.deb
http://security.debian.org/pool/updates/main/o/openldap2/libldap2-dev_2.0.23-6.3_s390.deb
http://security.debian.org/pool/updates/main/o/openldap2/slapd_2.0.23-6.3_s390.deb
Sun Sparc:
http://security.debian.org/pool/updates/main/o/openldap2/ldap-gateways_2.0.23-6.3_sparc.deb
http://security.debian.org/pool/updates/main/o/openldap2/ldap-utils_2.0.23-6.3_sparc.deb
http://security.debian.org/pool/updates/main/o/openldap2/libldap2_2.0.23-6.3_sparc.deb
http://security.debian.org/pool/updates/main/o/openldap2/libldap2-dev_2.0.23-6.3_sparc.deb
http://security.debian.org/pool/updates/main/o/openldap2/slapd_2.0.23-6.3_sparc.deb

Checksums MD5 dos arquivos listados estão disponíveis no alerta original.