compat, openldap security update

2010-07-21T18:18:04
ID CESA-2010:0542
Type centos
Reporter CentOS Project
Modified 2010-07-21T18:18:04

Description

CentOS Errata and Security Advisory CESA-2010:0542

OpenLDAP is an open source suite of LDAP (Lightweight Directory Access Protocol) applications and development tools.

Multiple flaws were discovered in the way the slapd daemon handled modify relative distinguished name (modrdn) requests. An authenticated user with privileges to perform modrdn operations could use these flaws to crash the slapd daemon via specially-crafted modrdn requests. (CVE-2010-0211, CVE-2010-0212)

Red Hat would like to thank CERT-FI for responsibly reporting these flaws, who credit Ilkka Mattila and Tuomas Salomaki for the discovery of the issues.

Users of OpenLDAP should upgrade to these updated packages, which contain a backported patch to correct these issues. After installing this update, the OpenLDAP daemons will be restarted automatically.

Merged security bulletin from advisories: http://lists.centos.org/pipermail/centos-announce/2010-July/016817.html http://lists.centos.org/pipermail/centos-announce/2010-July/016818.html

Affected packages: compat-openldap openldap openldap-clients openldap-devel openldap-servers openldap-servers-overlays openldap-servers-sql

Upstream details at: https://rhn.redhat.com/errata/RHSA-2010-0542.html