Bug 11720

I am sure, upstream will post a upgraded version in a few days.
There is an open bug (not reported)in upgrading the ldif file starting from version 1.3.2 that needs to be fixed.
mga needs the patch.

Versions 1.3.0.9 and 1.3.2.5 have been released fixing this:
http://port389.org/wiki/Releases/1.3.0.9
http://port389.org/wiki/Releases/1.3.2.5

Thanks a lot. 1.3.2.5 in cauldron has a freeze push on it.

Fixed in Cauldron in 389-ds-base-1.3.2.5-1.mga4.

Packages uploaded for Mageia 3 updates_testing:
389-ds-base-1.3.0.9-1.mga3
389-ds-base-libs-1.3.0.9-1.mga3
389-ds-base-devel-1.3.0.9-1.mga3

from 389-ds-base-1.3.0.9-1.mga3.src.rpm

Version: Cauldron => 3
Whiteboard: MGA3TOO => (none)

(In reply to David Walser from comment #4)
> Fixed in Cauldron in 389-ds-base-1.3.2.5-1.mga4.
> 
> Packages uploaded for Mageia 3 updates_testing:
> 389-ds-base-1.3.0.9-1.mga3
> 389-ds-base-libs-1.3.0.9-1.mga3
> 389-ds-base-devel-1.3.0.9-1.mga3
> 
> from 389-ds-base-1.3.0.9-1.mga3.src.rpm

I tested the update in mga3. I did not test a new install in mga3
I am going to assign this now to qa

Assignee: thomas => qa-bugs

Thanks Thomas.

Advisory:
========================

Updated 389-ds-base packages fix security vulnerability:

It was discovered that the 389 Directory Server did not properly handle
certain Get Effective Rights (GER) search queries when the attribute list,
which is a part of the query, included several names using the '@'
character. An attacker able to submit search queries to the 389 Directory
Server could cause it to crash (CVE-2013-4485).

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4485
http://port389.org/wiki/Releases/1.3.0.9
https://rhn.redhat.com/errata/RHSA-2013-1752.html
========================

Updated packages in core/updates_testing:
========================
389-ds-base-1.3.0.9-1.mga3
389-ds-base-libs-1.3.0.9-1.mga3
389-ds-base-devel-1.3.0.9-1.mga3

from 389-ds-base-1.3.0.9-1.mga3.src.rpm

CC: (none) => thomas

Testing complete mga3 32

# hostname laptop.local
# hostname
laptop.local

# setup-ds.pl 

==============================================================================
This program will set up the 389 Directory Server.

It is recommended that you have "root" privilege to set up the software.

..etc


Chose Express setup and when it asked for DN just hit enter and entered an 8 character password.

Directory Manager DN [cn=Directory Manager]: 
Password: 
Password (confirm): 
/sbin/semanage: SELinux policy is not managed or store cannot be accessed.
/sbin/semanage: SELinux policy is not managed or store cannot be accessed.
Your new DS instance 'laptop' was successfully created.
Exiting . . .
Log file is '/tmp/setupcyGVEh.log'


# systemctl start dirsrv@laptop.service
# systemctl status dirsrv@laptop.service
dirsrv@laptop.service - 389 Directory Server laptop.
          Loaded: loaded (/usr/lib/systemd/system/dirsrv@.service; enabled)
          Active: active (running) since Mon, 2013-11-25 13:40:28 GMT; 1min 31s ago

...etc

# netstat -pant | grep 389
tcp    0    0 0.0.0.0:389     0.0.0.0:*     LISTEN      23343/ns-slapd

Shows it listening on port 389 and the following command shows lots of info.

# ldapsearch -x -h localhost -s base -b ""  "objectclass=*"

# extended LDIF
#
# LDAPv3
# base <> with scope baseObject
# filter: objectclass=*
# requesting: ALL
#

#
dn:
objectClass: top
namingContexts: dc=local
defaultnamingcontext: dc=local

...etc

Whiteboard: (none) => has_procedure mga3-32-ok

Testing complete mga3 64

Validating. Advisory uploaded (after some faffing around)

Could sysadmin please push from 3 core/updates_testing to updates

Thanks!

Keywords: (none) => validated_update
Whiteboard: has_procedure mga3-32-ok => has_procedure advisory mga3-32-ok mga3-64-ok
CC: (none) => sysadmin-bugs

Update pushed:
http://advisories.mageia.org/MGASA-2013-0357.html

Status: ASSIGNED => RESOLVED
CC: (none) => tmb
Resolution: (none) => FIXED