389-ds-base-1.3.7.5-28.el7
エラータID: AXSA:2018-3329:08
リリース日:
2018/09/25 Tuesday - 21:09
題名:
389-ds-base-1.3.7.5-28.el7
影響のあるチャネル:
Asianux Server 7 for x86_64
Severity:
Moderate
Description:
以下項目について対処しました。
[Security Fix]
- 389-ds-base には、持続検索の処理中に競合状態になることを
利用して、匿名の攻撃者が DoS 攻撃を引き起こすことを可能と
する脆弱性があります。(CVE-2018-10850)
- 389-ds-base には、ユーザーがサーバーサイドのソートを用い
た ldapsearch を介して LDAP サーバーのクラッシュを起こすこ
とを可能とする脆弱性があります。(CVE-2018-10935)
- 389-ds-base には、エラーログのロック制御が適切に
処理されず、 log__error_emergency() でログファイルを新たに開
く際に、攻撃者が巨大な DN に大量の変更を送り続けることを介して、
slapd クラッシュを可能とする脆弱性があります。(CVE-2018-14624)
- 389-ds-base パッケージには、delete_passwdPolicy 関数において、
持続検索の接続が予期せず終了した場合、ns-slapd のプロセスがクラッシュしてしま
うため、リモートからの DoS 攻撃が可能となる脆弱性があります。(CVE-2018-14638)
一部CVEの翻訳文はJVNからの引用になります。
http://jvndb.jvn.jp/
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2018-10850
389-ds-base before versions 1.4.0.10, 1.3.8.3 is vulnerable to a race condition in the way 389-ds-base handles persistent search, resulting in a crash if the server is under load. An anonymous attacker could use this flaw to trigger a denial of service.
389-ds-base before versions 1.4.0.10, 1.3.8.3 is vulnerable to a race condition in the way 389-ds-base handles persistent search, resulting in a crash if the server is under load. An anonymous attacker could use this flaw to trigger a denial of service.
CVE-2018-10935
A flaw was found in the 389 Directory Server that allows users to cause a crash in the LDAP server using ldapsearch with server side sort.
A flaw was found in the 389 Directory Server that allows users to cause a crash in the LDAP server using ldapsearch with server side sort.
CVE-2018-14624
A vulnerability was discovered in 389-ds-base through versions 1.3.7.10, 1.3.8.8 and 1.4.0.16. The lock controlling the error log was not correctly used when re-opening the log file in log__error_emergency(). An attacker could send a flood of modifications to a very large DN, which would cause slapd to crash.
A vulnerability was discovered in 389-ds-base through versions 1.3.7.10, 1.3.8.8 and 1.4.0.16. The lock controlling the error log was not correctly used when re-opening the log file in log__error_emergency(). An attacker could send a flood of modifications to a very large DN, which would cause slapd to crash.
CVE-2018-14638
A flaw was found in 389-ds-base before version 1.3.8.4-13. The process ns-slapd crashes in delete_passwdPolicy function when persistent search connections are terminated unexpectedly leading to remote denial of service.
A flaw was found in 389-ds-base before version 1.3.8.4-13. The process ns-slapd crashes in delete_passwdPolicy function when persistent search connections are terminated unexpectedly leading to remote denial of service.
追加情報:
N/A
ダウンロード:
SRPMS
- 389-ds-base-1.3.7.5-28.el7.src.rpm
MD5: a389d1bd6eb11254b17a9cd935688897
SHA-256: db67662ed8bc846044ecfd99570d511beb1307519909e5b17e42964b15dc22ad
Size: 3.60 MB
Asianux Server 7 for x86_64
- 389-ds-base-1.3.7.5-28.el7.x86_64.rpm
MD5: 577a951c5d64bb3fd84fd3113238b0ee
SHA-256: 8647e3ec96b1d0aa654e91512350a55baa3ad89e691a6a391dc905884bad8bec
Size: 1.72 MB - 389-ds-base-libs-1.3.7.5-28.el7.x86_64.rpm
MD5: f5b72aece7dd0bf77fab6dea7646f393
SHA-256: 8d5f7362269478c19b25552d4952a7a6018cc7fb79ad51df1a48e1543a4ec4d7
Size: 696.93 kB
English