Nom du paquet
openldap
Date
2010-07-28
Advisory ID
MDVSA-2010:142
Affected versions
2009.0 x86_64 , MES5 i586 , 2010.1 i586 , 2010.0 x86_64 , 2010.0 i586 , 2009.1 i586 , 2009.0 i586 , CS4.0 i586 , 2008.0 x86_64 , CS4.0 x86_64 , 2008.0 i586 , 2009.1 x86_64 , MES5 x86_64 , 2010.1 x86_64

Problem description

Multiple vulnerabilities has been discovered and corrected in openldap:

The slap_modrdn2mods function in modrdn.c in OpenLDAP 2.4.22 does not
check the return value of a call to the smr_normalize function, which
allows remote attackers to cause a denial of service (segmentation
fault) and possibly execute arbitrary code via a modrdn call with an
RDN string containing invalid UTF-8 sequences, which triggers a free
of an invalid, uninitialized pointer in the slap_mods_free function, as
demonstrated using the Codenomicon LDAPv3 test suite (CVE-2010-0211).

OpenLDAP 2.4.22 allows remote attackers to cause a denial of service
(crash) via a modrdn call with a zero-length RDN destination string,
which is not properly handled by the smr_normalize function and
triggers a NULL pointer dereference in the IA5StringNormalize function
in schema_init.c, as demonstrated using the Codenomicon LDAPv3 test
suite (CVE-2010-0212).

Packages for 2008.0 and 2009.0 are provided as of the Extended
Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&products_id=490

The updated packages have been patched to correct these issues.

Updated packages

2009.0 x86_64

 1f0dc305dec801e492edc84fc8e00061  2009.0/x86_64/lib64ldap2.4_2-2.4.11-3.3mdv2009.0.x86_64.rpm
 77c3389cf341cd2a72d6e8161cd1f894  2009.0/x86_64/lib64ldap2.4_2-devel-2.4.11-3.3mdv2009.0.x86_64.rpm
 85bfe02ab43114eabc65069b1a2b3360  2009.0/x86_64/lib64ldap2.4_2-static-devel-2.4.11-3.3mdv2009.0.x86_64.rpm
 7721bf8ad4bc1aaf0ca09caa5aefb73e  2009.0/x86_64/openldap-2.4.11-3.3mdv2009.0.x86_64.rpm
 178cb0b7a75110d6b64bbd341d08b91a  2009.0/x86_64/openldap-clients-2.4.11-3.3mdv2009.0.x86_64.rpm
 f75365bb8422154dcc16fb73a8bd5410  2009.0/x86_64/openldap-doc-2.4.11-3.3mdv2009.0.x86_64.rpm
 7604c5d721c630348174a453467ac799  2009.0/x86_64/openldap-servers-2.4.11-3.3mdv2009.0.x86_64.rpm
 614334ed8ef6303f6709f2e950915375  2009.0/x86_64/openldap-testprogs-2.4.11-3.3mdv2009.0.x86_64.rpm
 875faf8dee0e61a0f7188a3d3ae5b885  2009.0/x86_64/openldap-tests-2.4.11-3.3mdv2009.0.x86_64.rpm 
 0a0568f3eca320267b4f6b2e9d5f99de  2009.0/SRPMS/openldap-2.4.11-3.3mdv2009.0.src.rpm

MES5 i586

 4fd998af6bd718e0fc457c428501fa4e  mes5/i586/libldap2.4_2-2.4.11-3.3mdvmes5.1.i586.rpm
 324ddd890ea4cc8cfc7c1b3f0c721cec  mes5/i586/libldap2.4_2-devel-2.4.11-3.3mdvmes5.1.i586.rpm
 22d01449812696eb9ab6564fa794752d  mes5/i586/libldap2.4_2-static-devel-2.4.11-3.3mdvmes5.1.i586.rpm
 fd0caddd82573d99fecbe57fd850f40c  mes5/i586/openldap-2.4.11-3.3mdvmes5.1.i586.rpm
 e089c0c4de14d82177b6ec9a7f1a5499  mes5/i586/openldap-clients-2.4.11-3.3mdvmes5.1.i586.rpm
 af27dd0a93bf0806263832f25dea30f2  mes5/i586/openldap-doc-2.4.11-3.3mdvmes5.1.i586.rpm
 fe133f20425e2f8fcfb573717b1bb187  mes5/i586/openldap-servers-2.4.11-3.3mdvmes5.1.i586.rpm
 bb314030b8753c5440cebdffb807979d  mes5/i586/openldap-testprogs-2.4.11-3.3mdvmes5.1.i586.rpm
 10d770ef4c137cdd7ccf0a209cab2014  mes5/i586/openldap-tests-2.4.11-3.3mdvmes5.1.i586.rpm 
 ffffc1d801bb8631cbd93bb39b9cb3cf  mes5/SRPMS/openldap-2.4.11-3.3mdvmes5.1.src.rpm

2010.1 i586

 674061eb33ede2fc880be95eac6b7cbf  2010.1/i586/libldap2.4_2-2.4.22-2.1mdv2010.1.i586.rpm
 b7014afab8beec155f8b697145284db3  2010.1/i586/libldap2.4_2-devel-2.4.22-2.1mdv2010.1.i586.rpm
 6c6f247fcdd3c2267a9d9396b58560c2  2010.1/i586/libldap2.4_2-static-devel-2.4.22-2.1mdv2010.1.i586.rpm
 bfdfe7c3f80906e5db8b5cd5931b9ec7  2010.1/i586/openldap-2.4.22-2.1mdv2010.1.i586.rpm
 602b79a8b1aaed19121afa4748c1f2cd  2010.1/i586/openldap-clients-2.4.22-2.1mdv2010.1.i586.rpm
 04097f0a8670dee06050d9241e0985a2  2010.1/i586/openldap-doc-2.4.22-2.1mdv2010.1.i586.rpm
 2633b177f01cfd1757917560d740dc90  2010.1/i586/openldap-servers-2.4.22-2.1mdv2010.1.i586.rpm
 727df6a967dbbc43412d9bbed65d52e9  2010.1/i586/openldap-testprogs-2.4.22-2.1mdv2010.1.i586.rpm
 e4bc125bcbc929e93c1d2122ddda6fcf  2010.1/i586/openldap-tests-2.4.22-2.1mdv2010.1.i586.rpm 
 1bedc617bd912dfd9f4710645298c59d  2010.1/SRPMS/openldap-2.4.22-2.1mdv2010.1.src.rpm

2010.0 x86_64

 e883d7634277bee4b64dd3ce58531860  2010.0/x86_64/lib64ldap2.4_2-2.4.19-2.1mdv2010.0.x86_64.rpm
 78bb96d659e9f4126e7ff22b183d8819  2010.0/x86_64/lib64ldap2.4_2-devel-2.4.19-2.1mdv2010.0.x86_64.rpm
 c5a8c127d705f840cdfb969a10d529c3  2010.0/x86_64/lib64ldap2.4_2-static-devel-2.4.19-2.1mdv2010.0.x86_64.rpm
 e47095e0be820d16228ba0e0771c56b3  2010.0/x86_64/openldap-2.4.19-2.1mdv2010.0.x86_64.rpm
 06ef73a1261c1cd3e07b1c383346cd7f  2010.0/x86_64/openldap-clients-2.4.19-2.1mdv2010.0.x86_64.rpm
 68a09d5efad1c11d9905817a0f4c8b7e  2010.0/x86_64/openldap-doc-2.4.19-2.1mdv2010.0.x86_64.rpm
 87fe9ae6f3163f140b4c3c23c9e441f3  2010.0/x86_64/openldap-servers-2.4.19-2.1mdv2010.0.x86_64.rpm
 1c2906f3a3e96b7e93e8f10b6caca2a3  2010.0/x86_64/openldap-testprogs-2.4.19-2.1mdv2010.0.x86_64.rpm
 30073ad2470aab5ad666669ea7c62dec  2010.0/x86_64/openldap-tests-2.4.19-2.1mdv2010.0.x86_64.rpm 
 f136b84e2564e5378fe32f491df92439  2010.0/SRPMS/openldap-2.4.19-2.1mdv2010.0.src.rpm

2010.0 i586

 c582f97df88d740b268adebe603a3d9e  2010.0/i586/libldap2.4_2-2.4.19-2.1mdv2010.0.i586.rpm
 da58a1da19074e4342689ddc4e5cd8c7  2010.0/i586/libldap2.4_2-devel-2.4.19-2.1mdv2010.0.i586.rpm
 d594623d22db6834d619a9a256f36c95  2010.0/i586/libldap2.4_2-static-devel-2.4.19-2.1mdv2010.0.i586.rpm
 fbf789c4531c502e8afb28f40739c487  2010.0/i586/openldap-2.4.19-2.1mdv2010.0.i586.rpm
 0c17594a7675f3f85edfd212e41eaad2  2010.0/i586/openldap-clients-2.4.19-2.1mdv2010.0.i586.rpm
 b432b4b453fa686b884111bd528f6888  2010.0/i586/openldap-doc-2.4.19-2.1mdv2010.0.i586.rpm
 b549adb80109c460f89d7b71e51884f5  2010.0/i586/openldap-servers-2.4.19-2.1mdv2010.0.i586.rpm
 4774bc9893190ab1da50a3ca2f515cae  2010.0/i586/openldap-testprogs-2.4.19-2.1mdv2010.0.i586.rpm
 14af5b706586c17cc2740447f249521b  2010.0/i586/openldap-tests-2.4.19-2.1mdv2010.0.i586.rpm 
 f136b84e2564e5378fe32f491df92439  2010.0/SRPMS/openldap-2.4.19-2.1mdv2010.0.src.rpm

2009.1 i586

 d4a2d41cca258c0dc87ea657d0e00569  2009.1/i586/libldap2.4_2-2.4.16-1.2mdv2009.1.i586.rpm
 036c89da1ea3d782d6c226078cf21d4f  2009.1/i586/libldap2.4_2-devel-2.4.16-1.2mdv2009.1.i586.rpm
 70831a1fe028692aaa03cd02c2cfb400  2009.1/i586/libldap2.4_2-static-devel-2.4.16-1.2mdv2009.1.i586.rpm
 f568004ca21b2fd01edf99c80ced540c  2009.1/i586/openldap-2.4.16-1.2mdv2009.1.i586.rpm
 a231549516ab4eda4c60870523ede860  2009.1/i586/openldap-clients-2.4.16-1.2mdv2009.1.i586.rpm
 c1878219fc5b93d391d3a2c0ff0ed8f1  2009.1/i586/openldap-doc-2.4.16-1.2mdv2009.1.i586.rpm
 5806259034d52c3141f956a66f0d9976  2009.1/i586/openldap-servers-2.4.16-1.2mdv2009.1.i586.rpm
 7672b9cefc322b508766a1925be60604  2009.1/i586/openldap-testprogs-2.4.16-1.2mdv2009.1.i586.rpm
 df0577b169fa72546927fddb6af86ab5  2009.1/i586/openldap-tests-2.4.16-1.2mdv2009.1.i586.rpm 
 77bd37ef46df1b87d1a43ade6a6c6097  2009.1/SRPMS/openldap-2.4.16-1.2mdv2009.1.src.rpm

2009.0 i586

 d457f06402953bf41d9ac66ac6a7aa64  2009.0/i586/libldap2.4_2-2.4.11-3.3mdv2009.0.i586.rpm
 855126a1464aa00580886d3f3b7a317b  2009.0/i586/libldap2.4_2-devel-2.4.11-3.3mdv2009.0.i586.rpm
 9dbf0408c39216a0a142195f5b47a51a  2009.0/i586/libldap2.4_2-static-devel-2.4.11-3.3mdv2009.0.i586.rpm
 82f7e36d37f009942bb105092c21b280  2009.0/i586/openldap-2.4.11-3.3mdv2009.0.i586.rpm
 16dbf378a19902713c0f9bba31358455  2009.0/i586/openldap-clients-2.4.11-3.3mdv2009.0.i586.rpm
 af3cf5fc20e6cfa2d44efc50116f84c5  2009.0/i586/openldap-doc-2.4.11-3.3mdv2009.0.i586.rpm
 d5727d9472d31123a8c3b4a284af2d52  2009.0/i586/openldap-servers-2.4.11-3.3mdv2009.0.i586.rpm
 32a5895f78bea22a051699b4ed9f93f3  2009.0/i586/openldap-testprogs-2.4.11-3.3mdv2009.0.i586.rpm
 fadb9e6d3a595249bf88ae48c609adc5  2009.0/i586/openldap-tests-2.4.11-3.3mdv2009.0.i586.rpm 
 0a0568f3eca320267b4f6b2e9d5f99de  2009.0/SRPMS/openldap-2.4.11-3.3mdv2009.0.src.rpm

CS4.0 i586

 1c7d8fdf08331f11a3a5eacf6a7d9e32  corporate/4.0/i586/libldap2.3_0-2.3.27-1.7.20060mlcs4.i586.rpm
 d1ba0c11272c846178fb87a50beb4adf  corporate/4.0/i586/libldap2.3_0-devel-2.3.27-1.7.20060mlcs4.i586.rpm
 79196cec543c6ef7a3186c23d8a9521c  corporate/4.0/i586/libldap2.3_0-static-devel-2.3.27-1.7.20060mlcs4.i586.rpm
 ddfd3e38f81a0377ba53f76b444c572c  corporate/4.0/i586/openldap-2.3.27-1.7.20060mlcs4.i586.rpm
 de6ccff62b0d20d40909e11352c228e9  corporate/4.0/i586/openldap-clients-2.3.27-1.7.20060mlcs4.i586.rpm
 88b5898121e94bccea89daf167f0f752  corporate/4.0/i586/openldap-doc-2.3.27-1.7.20060mlcs4.i586.rpm
 bab597d960c3beba7c4038707b0e97a4  corporate/4.0/i586/openldap-servers-2.3.27-1.7.20060mlcs4.i586.rpm 
 76b93fec2d6181b7990e0fd024db1a83  corporate/4.0/SRPMS/openldap-2.3.27-1.7.20060mlcs4.src.rpm

2008.0 x86_64

 dffb422c6ad84b4f682b271165125245  2008.0/x86_64/lib64ldap2.3_0-2.3.38-3.5mdv2008.0.x86_64.rpm
 05e51f393f9b683ee5f309a001f94453  2008.0/x86_64/lib64ldap2.3_0-devel-2.3.38-3.5mdv2008.0.x86_64.rpm
 40cf33cd99e57d50bca4207350c7a4ee  2008.0/x86_64/lib64ldap2.3_0-static-devel-2.3.38-3.5mdv2008.0.x86_64.rpm
 e72e6b9fdbf6124e709709eeb53a5424  2008.0/x86_64/openldap-2.3.38-3.5mdv2008.0.x86_64.rpm
 2d67e3045491a73c1ecca4ee148f890f  2008.0/x86_64/openldap-clients-2.3.38-3.5mdv2008.0.x86_64.rpm
 39bbd7bd39c82ffe083427e4649cfba5  2008.0/x86_64/openldap-doc-2.3.38-3.5mdv2008.0.x86_64.rpm
 fcbb12e9a4674a4a92dd04b695ca762d  2008.0/x86_64/openldap-servers-2.3.38-3.5mdv2008.0.x86_64.rpm
 1dac71eccd0ccdfc3aeda5a78df892e7  2008.0/x86_64/openldap-testprogs-2.3.38-3.5mdv2008.0.x86_64.rpm
 cb1dbab5ebc78c59f048da91b9703361  2008.0/x86_64/openldap-tests-2.3.38-3.5mdv2008.0.x86_64.rpm 
 b5889315b832465659ff66503bb6944d  2008.0/SRPMS/openldap-2.3.38-3.5mdv2008.0.src.rpm

CS4.0 x86_64

 d473f1746238db1e800ee9a5bcf6d998  corporate/4.0/x86_64/lib64ldap2.3_0-2.3.27-1.7.20060mlcs4.x86_64.rpm
 d8cd847281b4e3913df0fc387a5ad7dc  corporate/4.0/x86_64/lib64ldap2.3_0-devel-2.3.27-1.7.20060mlcs4.x86_64.rpm
 f5160774c2fbd38d4107189a9fd1f4af  corporate/4.0/x86_64/lib64ldap2.3_0-static-devel-2.3.27-1.7.20060mlcs4.x86_64.rpm
 648a9337b5d4d767af8c3935993d9510  corporate/4.0/x86_64/openldap-2.3.27-1.7.20060mlcs4.x86_64.rpm
 6916f332fd61ffb342412ff707ba7cd2  corporate/4.0/x86_64/openldap-clients-2.3.27-1.7.20060mlcs4.x86_64.rpm
 1d517b60530d07a512eba6d58828f201  corporate/4.0/x86_64/openldap-doc-2.3.27-1.7.20060mlcs4.x86_64.rpm
 f82c8eb89405e38b69527167ab5c6df0  corporate/4.0/x86_64/openldap-servers-2.3.27-1.7.20060mlcs4.x86_64.rpm 
 76b93fec2d6181b7990e0fd024db1a83  corporate/4.0/SRPMS/openldap-2.3.27-1.7.20060mlcs4.src.rpm

2008.0 i586

 a7040ed1d2e4922f3c20d8183d45f5a9  2008.0/i586/libldap2.3_0-2.3.38-3.5mdv2008.0.i586.rpm
 b1c09c5812b180b01fb82462be3a1227  2008.0/i586/libldap2.3_0-devel-2.3.38-3.5mdv2008.0.i586.rpm
 64010da2c45dcc2fcdc959dca532e43f  2008.0/i586/libldap2.3_0-static-devel-2.3.38-3.5mdv2008.0.i586.rpm
 af8ba2a7984616b44e6e97e70e09e684  2008.0/i586/openldap-2.3.38-3.5mdv2008.0.i586.rpm
 19fa25f30f69d5036b66358a1e964b98  2008.0/i586/openldap-clients-2.3.38-3.5mdv2008.0.i586.rpm
 8cec1f954d49079739101464ba424862  2008.0/i586/openldap-doc-2.3.38-3.5mdv2008.0.i586.rpm
 b6c2a87d11d9022f53a1488cf15bf58a  2008.0/i586/openldap-servers-2.3.38-3.5mdv2008.0.i586.rpm
 9e135815d465c821300215115b194c95  2008.0/i586/openldap-testprogs-2.3.38-3.5mdv2008.0.i586.rpm
 bc1239e1cb30f2c27a4532711fb9daeb  2008.0/i586/openldap-tests-2.3.38-3.5mdv2008.0.i586.rpm 
 b5889315b832465659ff66503bb6944d  2008.0/SRPMS/openldap-2.3.38-3.5mdv2008.0.src.rpm

2009.1 x86_64

 c68af2323836b445663c47a9093136ca  2009.1/x86_64/lib64ldap2.4_2-2.4.16-1.2mdv2009.1.x86_64.rpm
 1943dc9365929b6affc05feeafe4078a  2009.1/x86_64/lib64ldap2.4_2-devel-2.4.16-1.2mdv2009.1.x86_64.rpm
 43ab67b061a6673799b420f61f2f9030  2009.1/x86_64/lib64ldap2.4_2-static-devel-2.4.16-1.2mdv2009.1.x86_64.rpm
 ba150d3290773567135bef70620041c5  2009.1/x86_64/openldap-2.4.16-1.2mdv2009.1.x86_64.rpm
 251b0e0b679f1f1c510b2ae8c7dcaac4  2009.1/x86_64/openldap-clients-2.4.16-1.2mdv2009.1.x86_64.rpm
 c75ae8daf5f7b9524c4d0999fefc6bf8  2009.1/x86_64/openldap-doc-2.4.16-1.2mdv2009.1.x86_64.rpm
 f1c4de1210c7b57f1b10c741bbb133dd  2009.1/x86_64/openldap-servers-2.4.16-1.2mdv2009.1.x86_64.rpm
 5b45a0d4fb15c71603cd9a04c5c0edaa  2009.1/x86_64/openldap-testprogs-2.4.16-1.2mdv2009.1.x86_64.rpm
 15623d71c00fe261d94153c5325a0b0a  2009.1/x86_64/openldap-tests-2.4.16-1.2mdv2009.1.x86_64.rpm 
 77bd37ef46df1b87d1a43ade6a6c6097  2009.1/SRPMS/openldap-2.4.16-1.2mdv2009.1.src.rpm

MES5 x86_64

 4677f2c088c4377876fbad8d42b9e149  mes5/x86_64/lib64ldap2.4_2-2.4.11-3.3mdvmes5.1.x86_64.rpm
 7fea8ea62e0af1d9c2577db737415d36  mes5/x86_64/lib64ldap2.4_2-devel-2.4.11-3.3mdvmes5.1.x86_64.rpm
 159b1e576e018fd368a71de46824b2bb  mes5/x86_64/lib64ldap2.4_2-static-devel-2.4.11-3.3mdvmes5.1.x86_64.rpm
 9b7d324296c7b1e60dfc19944266baf0  mes5/x86_64/openldap-2.4.11-3.3mdvmes5.1.x86_64.rpm
 9d3cd93949ef1fc4ed017753d23ab119  mes5/x86_64/openldap-clients-2.4.11-3.3mdvmes5.1.x86_64.rpm
 16cdec6e19b3183016ab96a41656d89c  mes5/x86_64/openldap-doc-2.4.11-3.3mdvmes5.1.x86_64.rpm
 210b46799fb19c6a6cfffdfa2ea8d363  mes5/x86_64/openldap-servers-2.4.11-3.3mdvmes5.1.x86_64.rpm
 b76d1f8ee367b6f8801a61df446f38fc  mes5/x86_64/openldap-testprogs-2.4.11-3.3mdvmes5.1.x86_64.rpm
 87e2dbec1afd666e6bffc882b4d9388b  mes5/x86_64/openldap-tests-2.4.11-3.3mdvmes5.1.x86_64.rpm 
 ffffc1d801bb8631cbd93bb39b9cb3cf  mes5/SRPMS/openldap-2.4.11-3.3mdvmes5.1.src.rpm

2010.1 x86_64

 b4b9ef21a66b0086d3c5d1348dd87392  2010.1/x86_64/lib64ldap2.4_2-2.4.22-2.1mdv2010.1.x86_64.rpm
 d16d58ed3bf9256771ecfd8996b15d9b  2010.1/x86_64/lib64ldap2.4_2-devel-2.4.22-2.1mdv2010.1.x86_64.rpm
 dc00ac52a31e05ab6a52e56a786d7c20  2010.1/x86_64/lib64ldap2.4_2-static-devel-2.4.22-2.1mdv2010.1.x86_64.rpm
 9e9ec6e05a680ad686e992b13781e671  2010.1/x86_64/openldap-2.4.22-2.1mdv2010.1.x86_64.rpm
 889681834ca9262e7601797a8cd9fc30  2010.1/x86_64/openldap-clients-2.4.22-2.1mdv2010.1.x86_64.rpm
 94407d4c6204f60650e11ab33584f9d3  2010.1/x86_64/openldap-doc-2.4.22-2.1mdv2010.1.x86_64.rpm
 a73ca8a93a0eb0ed01f04b15ac250bc2  2010.1/x86_64/openldap-servers-2.4.22-2.1mdv2010.1.x86_64.rpm
 6d95ea417328d4467c4f907a764f97d5  2010.1/x86_64/openldap-testprogs-2.4.22-2.1mdv2010.1.x86_64.rpm
 2d77b08ce9c751b7d9b944d493c8a677  2010.1/x86_64/openldap-tests-2.4.22-2.1mdv2010.1.x86_64.rpm 
 1bedc617bd912dfd9f4710645298c59d  2010.1/SRPMS/openldap-2.4.22-2.1mdv2010.1.src.rpm

References