exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Mandriva Linux Security Advisory 2015-225

Mandriva Linux Security Advisory 2015-225
Posted May 4, 2015
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2015-225 - The cherokee_validator_ldap_check function in validator_ldap.c in Cherokee 1.2.103 and earlier, when LDAP is used, does not properly consider unauthenticated-bind semantics, which allows remote attackers to bypass authentication via an empty password.

tags | advisory, remote
systems | linux, mandriva
advisories | CVE-2014-4668
SHA-256 | dab516d1e414f9cb5ef007848b5664d9265d2181a6cb393863fc45b55d592f05

Mandriva Linux Security Advisory 2015-225

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2015:225
http://www.mandriva.com/en/support/security/
_______________________________________________________________________

Package : cherokee
Date : May 4, 2015
Affected: Business Server 1.0
_______________________________________________________________________

Problem Description:

Updated cherokee packages fix security vulnerability:

The cherokee_validator_ldap_check function in validator_ldap.c in
Cherokee 1.2.103 and earlier, when LDAP is used, does not properly
consider unauthenticated-bind semantics, which allows remote attackers
to bypass authentication via an empty password (CVE-2014-4668).
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4668
http://advisories.mageia.org/MGASA-2015-0181.html
_______________________________________________________________________

Updated Packages:

Mandriva Business Server 1/X86_64:
da0714c2694349901f329b7be76cb17f mbs1/x86_64/cget-1.2.101-8.1.mbs1.x86_64.rpm
387a32522ce8dd469d8f6689f1ad8b17 mbs1/x86_64/cherokee-1.2.101-8.1.mbs1.x86_64.rpm
4e4d4cf5c6fa797bcd95223f3ad396a8 mbs1/x86_64/cherokee-devel-1.2.101-8.1.mbs1.x86_64.rpm
5c1c910636c338173bc7df734811ad72 mbs1/x86_64/lib64cherokee-base0-1.2.101-8.1.mbs1.x86_64.rpm
0e94af76b87329e56783b01e26cf7cfb mbs1/x86_64/lib64cherokee-client0-1.2.101-8.1.mbs1.x86_64.rpm
f6e55ca4dd2f0c7350380d0af98d4c82 mbs1/x86_64/lib64cherokee-server0-1.2.101-8.1.mbs1.x86_64.rpm
2bd3ca3626fe3cc446d006160bcfeb84 mbs1/SRPMS/cherokee-1.2.101-8.1.mbs1.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFVR5lkmqjQ0CJFipgRAkz/AJ92e0TE8pG5hAa4+jcOUOeOMjxGxwCfQvqP
XKs0Xx65F8w1nnYDBZ57Gps=
=Zi00
-----END PGP SIGNATURE-----
Login or Register to add favorites

File Archive:

July 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    27 Files
  • 2
    Jul 2nd
    10 Files
  • 3
    Jul 3rd
    35 Files
  • 4
    Jul 4th
    27 Files
  • 5
    Jul 5th
    18 Files
  • 6
    Jul 6th
    0 Files
  • 7
    Jul 7th
    0 Files
  • 8
    Jul 8th
    28 Files
  • 9
    Jul 9th
    44 Files
  • 10
    Jul 10th
    24 Files
  • 11
    Jul 11th
    25 Files
  • 12
    Jul 12th
    11 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    0 Files
  • 16
    Jul 16th
    0 Files
  • 17
    Jul 17th
    0 Files
  • 18
    Jul 18th
    0 Files
  • 19
    Jul 19th
    0 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close