=========================================================== Ubuntu Security Notice USN-152-1 July 21, 2005 openldap2, libpam-ldap, libnss-ldap vulnerabilities CAN-2005-2069 =========================================================== A security issue affects the following Ubuntu releases: Ubuntu 4.10 (Warty Warthog) Ubuntu 5.04 (Hoary Hedgehog) The following packages are affected: libnss-ldap libpam-ldap slapd On Ubuntu 4.10, the problem can be corrected by upgrading the affected packages to version 2.1.30-2ubuntu4.1 (slapd), 164-2ubuntu0.1 (libpam-ldap), and 220-1ubuntu0.1 (libnss-ldap). On Ubuntu 5.04, the problem can be corrected by upgrading the affected packages to version 2.1.30-3ubuntu3.1 (slapd), 169-1ubuntu0.1 (libpam-ldap), and 220-1ubuntu0.1 (libnss-ldap). In general, a standard system upgrade is sufficient to effect the necessary changes. (Please note that libnss-ldap and libpam-ldap are not officially supported by Ubuntu, they are in the "universe" suite of the archive.) Details follow: Andrea Barisani discovered a flaw in the SSL handling of pam-ldap and libnss-ldap. When a client connected to a slave LDAP server using SSL, the slave server did not use SSL as well when contacting the LDAP master server. This caused passwords and other confident information to be transmitted unencrypted between the slave and the master. Updated packages for Ubuntu 4.10 (Warty Warthog): Source archives: http://security.ubuntu.com/ubuntu/pool/universe/libn/libnss-ldap/libnss-ldap_211-4ubuntu0.1.diff.gz Size/MD5: 40012 180bfdaf8ddf765fbffd5a671c2e08e5 http://security.ubuntu.com/ubuntu/pool/universe/libn/libnss-ldap/libnss-ldap_211-4ubuntu0.1.dsc Size/MD5: 687 6b1c2784a1033e5ec81903976c950331 http://security.ubuntu.com/ubuntu/pool/universe/libn/libnss-ldap/libnss-ldap_211.orig.tar.gz Size/MD5: 221013 34adcab5d46a436617ae686cc7c5e78f http://security.ubuntu.com/ubuntu/pool/universe/libp/libpam-ldap/libpam-ldap_164-2ubuntu0.1.diff.gz Size/MD5: 31544 8d085bc008fe5ac70b2a0ad6d56f92f8 http://security.ubuntu.com/ubuntu/pool/universe/libp/libpam-ldap/libpam-ldap_164-2ubuntu0.1.dsc Size/MD5: 678 da1e9384d50f7b968adf547d829b7315 http://security.ubuntu.com/ubuntu/pool/universe/libp/libpam-ldap/libpam-ldap_164.orig.tar.gz Size/MD5: 116873 0b5d6ef6735480210d27a3d969f59e12 http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/openldap2_2.1.30-2ubuntu4.1.diff.gz Size/MD5: 116650 89863ef77edba510914cfdad0d3348ef http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/openldap2_2.1.30-2ubuntu4.1.dsc Size/MD5: 971 a430e9d325011aa5707b511f64d239dd http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/openldap2_2.1.30.orig.tar.gz Size/MD5: 2044673 e2ae8148c4bed07d7a70edd930bdc403 Architecture independent packages: http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/libslapd2-dev_2.1.30-2ubuntu4.1_all.deb Size/MD5: 71854 f2b7772fa613690daa5eb85afcd13a34 amd64 architecture (Athlon64, Opteron, EM64T Xeon) http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/ldap-utils_2.1.30-2ubuntu4.1_amd64.deb Size/MD5: 125906 79af7aa37ff71b874214b90ee9ecae1e http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/libldap2-dev_2.1.30-2ubuntu4.1_amd64.deb Size/MD5: 360024 986821f16397c44875c6f9631e376620 http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/libldap2_2.1.30-2ubuntu4.1_amd64.deb Size/MD5: 308242 d4047e25be22bcf3064f3401d3827a4f http://security.ubuntu.com/ubuntu/pool/universe/libn/libnss-ldap/libnss-ldap_211-4ubuntu0.1_amd64.deb Size/MD5: 69096 4dce5370da2e0f675d274801f993ac05 http://security.ubuntu.com/ubuntu/pool/universe/libp/libpam-ldap/libpam-ldap_164-2ubuntu0.1_amd64.deb Size/MD5: 49546 bdda10f11dae5c0eb89aae5dcb58f17d http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/slapd_2.1.30-2ubuntu4.1_amd64.deb Size/MD5: 1000922 d0cccba6c649de288204b677c051763c i386 architecture (x86 compatible Intel/AMD) http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/ldap-utils_2.1.30-2ubuntu4.1_i386.deb Size/MD5: 111448 146b9142a0148940068a0e583c0f05bd http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/libldap2-dev_2.1.30-2ubuntu4.1_i386.deb Size/MD5: 316880 5828ac19e41a9dfd6f42acc754cb3c5d http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/libldap2_2.1.30-2ubuntu4.1_i386.deb Size/MD5: 283620 2750618047fc01d8393a773caea6ee4f http://security.ubuntu.com/ubuntu/pool/universe/libn/libnss-ldap/libnss-ldap_211-4ubuntu0.1_i386.deb Size/MD5: 67978 a2a3f9a58c2a01b9e03f8f7e28575b80 http://security.ubuntu.com/ubuntu/pool/universe/libp/libpam-ldap/libpam-ldap_164-2ubuntu0.1_i386.deb Size/MD5: 49208 cd423f7aa2211f49110913d661f9effe http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/slapd_2.1.30-2ubuntu4.1_i386.deb Size/MD5: 902696 5acca424b573c4359cfd26e41677ce0c powerpc architecture (Apple Macintosh G3/G4/G5) http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/ldap-utils_2.1.30-2ubuntu4.1_powerpc.deb Size/MD5: 127948 1a88da127a39484da2c2d0fb782ae0ac http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/libldap2-dev_2.1.30-2ubuntu4.1_powerpc.deb Size/MD5: 371714 e3579e3bedba4e79e4817178aae191de http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/libldap2_2.1.30-2ubuntu4.1_powerpc.deb Size/MD5: 301834 207ffdaf7d6a59efeed541c1186826be http://security.ubuntu.com/ubuntu/pool/universe/libn/libnss-ldap/libnss-ldap_211-4ubuntu0.1_powerpc.deb Size/MD5: 70402 4dd21e0f29aacf85c3e8caef7ac04ccb http://security.ubuntu.com/ubuntu/pool/universe/libp/libpam-ldap/libpam-ldap_164-2ubuntu0.1_powerpc.deb Size/MD5: 49762 c10ceae89d679444cab7d150d709d09c http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/slapd_2.1.30-2ubuntu4.1_powerpc.deb Size/MD5: 975904 b3c3f67196e71eb563e501f55bc97dd8 Updated packages for Ubuntu 5.04 (Hoary Hedgehog): Source archives: http://security.ubuntu.com/ubuntu/pool/universe/libn/libnss-ldap/libnss-ldap_220-1ubuntu0.1.diff.gz Size/MD5: 26873 59ccd69249e345d2f535a4b6bdf323dd http://security.ubuntu.com/ubuntu/pool/universe/libn/libnss-ldap/libnss-ldap_220-1ubuntu0.1.dsc Size/MD5: 687 660f621b904c8cc6db16a1027bca370c http://security.ubuntu.com/ubuntu/pool/universe/libn/libnss-ldap/libnss-ldap_220.orig.tar.gz Size/MD5: 204826 d401485fcabf4ea40d244c2c9a19247e http://security.ubuntu.com/ubuntu/pool/universe/libp/libpam-ldap/libpam-ldap_169-1ubuntu0.1.diff.gz Size/MD5: 26203 f6618a137174a52f3eaa2c6dc357b434 http://security.ubuntu.com/ubuntu/pool/universe/libp/libpam-ldap/libpam-ldap_169-1ubuntu0.1.dsc Size/MD5: 678 ba2b65635fcc64aefc6a12c2c90b3bd0 http://security.ubuntu.com/ubuntu/pool/universe/libp/libpam-ldap/libpam-ldap_169.orig.tar.gz Size/MD5: 119817 62abfe9c5d62e7d112c12d0e5863129f http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/openldap2_2.1.30-3ubuntu3.1.diff.gz Size/MD5: 117295 743d542b68dd5d743527ac15500b8b51 http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/openldap2_2.1.30-3ubuntu3.1.dsc Size/MD5: 988 abcae0bb7933a4634c0562c41b17a4d5 http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/openldap2_2.1.30.orig.tar.gz Size/MD5: 2044673 e2ae8148c4bed07d7a70edd930bdc403 Architecture independent packages: http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/libslapd2-dev_2.1.30-3ubuntu3.1_all.deb Size/MD5: 72308 60a8341fad6776f7da90291b0c0a41e5 amd64 architecture (Athlon64, Opteron, EM64T Xeon) http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/ldap-utils_2.1.30-3ubuntu3.1_amd64.deb Size/MD5: 126282 504170293b367b3d3960c19619386368 http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/libldap2-dev_2.1.30-3ubuntu3.1_amd64.deb Size/MD5: 361172 fc2aaa72ddc00c7ea6e9118d18532672 http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/libldap2_2.1.30-3ubuntu3.1_amd64.deb Size/MD5: 309092 62bb57d16d2e0b7ef505d9023eacc687 http://security.ubuntu.com/ubuntu/pool/universe/libn/libnss-ldap/libnss-ldap_220-1ubuntu0.1_amd64.deb Size/MD5: 74590 f1087a8146dd42601bbc990f8d1c755d http://security.ubuntu.com/ubuntu/pool/universe/libp/libpam-ldap/libpam-ldap_169-1ubuntu0.1_amd64.deb Size/MD5: 52078 6057c9f1597d80a2c162837b25f2e9a7 http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/slapd_2.1.30-3ubuntu3.1_amd64.deb Size/MD5: 1087990 a8a2b8b425be64cb3fcf5a32a8d83416 i386 architecture (x86 compatible Intel/AMD) http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/ldap-utils_2.1.30-3ubuntu3.1_i386.deb Size/MD5: 110644 d52d6dd0c45e8532c6170ddf1a52f19c http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/libldap2-dev_2.1.30-3ubuntu3.1_i386.deb Size/MD5: 317990 4e54bf4ec7dc799de00bf8bf0711bded http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/libldap2_2.1.30-3ubuntu3.1_i386.deb Size/MD5: 284484 89c8c1a89831713025896642ccccd900 http://security.ubuntu.com/ubuntu/pool/universe/libn/libnss-ldap/libnss-ldap_220-1ubuntu0.1_i386.deb Size/MD5: 73536 ed6ee791428191886b86d29063997565 http://security.ubuntu.com/ubuntu/pool/universe/libp/libpam-ldap/libpam-ldap_169-1ubuntu0.1_i386.deb Size/MD5: 51670 384be799688e0277feb86b4508288699 http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/slapd_2.1.30-3ubuntu3.1_i386.deb Size/MD5: 979238 3e2fad1ffb1b9d7eac366467da98e3ce powerpc architecture (Apple Macintosh G3/G4/G5) http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/ldap-utils_2.1.30-3ubuntu3.1_powerpc.deb Size/MD5: 129544 bb935cbb6fc5e7670646607d0c481ff6 http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/libldap2-dev_2.1.30-3ubuntu3.1_powerpc.deb Size/MD5: 373102 fbd4736d7f2167db5a204609f08076e6 http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/libldap2_2.1.30-3ubuntu3.1_powerpc.deb Size/MD5: 302728 8e97eb53df941a8d4546f3de39477aa7 http://security.ubuntu.com/ubuntu/pool/universe/libn/libnss-ldap/libnss-ldap_220-1ubuntu0.1_powerpc.deb Size/MD5: 75784 8d77afd6f2a602294cc1d953b9995c38 http://security.ubuntu.com/ubuntu/pool/universe/libp/libpam-ldap/libpam-ldap_169-1ubuntu0.1_powerpc.deb Size/MD5: 52180 40ef599a113e873a235b76f315a444d2 http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/slapd_2.1.30-3ubuntu3.1_powerpc.deb Size/MD5: 1058104 59a515083487c2218c4acefb99bee97d