January 2005
Red Hat Netscape Directory Server stack buffer overflow vulnerability
ID: 00028
Ref: 25/05
Date: 12 January 2005:14:07:12
Version: 1
Title: Red Hat Netscape Directory Server stack buffer overflow vulnerability
Abstract: Patches for Netscape Directory Server that fix a remotely exploitable security issue are now available.
Vendors affected: Red Hat
Applications affected: Red Hat
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- ---------------------------------------------------------------------
Red Hat Security Advisory
Synopsis: Netscape Directory Server: Patches fix security issue
Advisory ID: RHSA-2005:030-01
Advisory URL: https://rhn.redhat.com/errata/RHSA-2005-030.html
Issue date: 2005-01-11
Updated on: 2005-01-11
Product: Netscape Directory Server
CVE Names: CAN-2004-1236
- ---------------------------------------------------------------------
1. Summary:
Patches for Netscape Directory Server that fix a remotely exploitable
security issue are now available.
2. Problem description:
In December 2004 Red Hat aquired the Netscape Directory Server product from
America Online, Inc.
A stack buffer overflow was found in the access control code in Netscape
Directory Server 6.21 and earlier. A remote attacker who can communicate
with the LDAP service could trigger this flaw by creating a carefully
crafted attribute change request. A sucessful exploit would lead to a
denial of service (crash) or potentially to remote code execution on the
server.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2004-1236 to this issue.
3. Solution:
Patches in the form of updated libraries that correct this issue are
available on request from the Red Hat Security Response Team, please contact
secalert@redhat.com
4. References:
http://www.kb.cert.org/vuls/id/258905
http://www.redhat.com/about/presscenter/2004/press_neighbor.html
http://marc.theaimsgroup.com/?l=bugtraq&m=110384298016120
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1236
5. Contact:
The Red Hat security contact is . More contact
details at https://www.redhat.com/security/team/contact/
Copyright 2005 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)
iD8DBQFB48K3XlSAg2UNWIIRAl0FAJ95f/CPqjZNlOnPDkRKSQr1LSSvHwCgoetM
61k3sJm/8WvGaIGcLRI0RAU=
=ElLK
-----END PGP SIGNATURE-----