-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2013:106 http://www.mandriva.com/en/support/security/ _______________________________________________________________________ Package : nss-pam-ldapd Date : April 10, 2013 Affected: Business Server 1.0 _______________________________________________________________________ Problem Description: Updated nss-pam-ldapd packages fixes the following security vulnerability: Garth Mollett discovered that a file descriptor overflow issue in the use of FD_SET() in nss-pam-ldapd can lead to a stack-based buffer overflow. An attacker could, under some circumstances, use this flaw to cause a process that has the NSS or PAM module loaded to crash or potentially execute arbitrary code. The issue can be triggered in a network daemon by opening a large number of connections and forcing a name lookup. This would result in a crash and possibly remote code execution. This issue may also allow local privilege escalation if a suid program does name lookups and doesn't close file descriptors inherited from the parent process (CVE-2013-0288). _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0288 https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0071 _______________________________________________________________________ Updated Packages: Mandriva Business Server 1/X86_64: cbf543dd3fef9f555cff3437e2a38639 mbs1/x86_64/nss-pam-ldapd-0.8.6-4.1.mbs1.x86_64.rpm 4e6bf408943ff751ed7655b661bec550 mbs1/SRPMS/nss-pam-ldapd-0.8.6-4.1.mbs1.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/en/support/security/advisories/ If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iD8DBQFRZSHrmqjQ0CJFipgRAgbfAKCSr8sXuhi6fqHiGAPnN1bsPifwpwCfSfpy bdicQKUhJy3d51gHAEHQZHA= =tafI -----END PGP SIGNATURE-----