389 security update

CentOS Errata and Security Advisory CESA-2017:0893

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

Security Fix(es):

• An invalid pointer dereference flaw was found in the way 389-ds-base handled LDAP bind requests. A remote unauthenticated attacker could use this flaw to make ns-slapd crash via a specially crafted LDAP bind request, resulting in denial of service. (CVE-2017-2668)

Red Hat would like to thank Joachim Jabs (F24) for reporting this issue.

Bug Fix(es):

• Previously, the “deref” plug-in failed to dereference attributes that use distinguished name (DN) syntax, such as “uniqueMember”. With this patch, the “deref” plug-in can dereference such attributes and additionally “Name and Optional UID” syntax. As a result, the “deref” plug-in now supports any syntax. (BZ#1435365)

Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2017-April/084517.html

Affected packages:
389-ds-base
389-ds-base-devel
389-ds-base-libs

Upstream details at:
https://access.redhat.com/errata/RHSA-2017:0893