Bug 15796

Summary: 389-ds-base new security issue CVE-2015-1854
Product: Mageia Reporter: David Walser <luigiwalser>
Component: SecurityAssignee: QA Team <qa-bugs>
Status: RESOLVED FIXED QA Contact: Sec team <security>
Severity: critical    
Priority: Normal CC: shlomif, sysadmin-bugs, thomas
Version: 4Keywords: validated_update
Target Milestone: ---   
Hardware: i586   
OS: Linux   
URL: http://lwn.net/Vulnerabilities/642378/
Whiteboard: MGA4-64-OK has_procedure advisory MGA4-32-OK
Source RPM: 389-ds-base-1.3.3.9-1.mga5.src.rpm CVE:
Status comment:

Description David Walser 2015-04-29 19:01:13 CEST
RedHat has issued an advisory on April 28:
https://rhn.redhat.com/errata/RHSA-2015-0895.html

Reproducible: 

Steps to Reproduce:
Comment 1 David Walser 2015-04-29 19:02:06 CEST
The patches RedHat added are in this commit:
https://git.centos.org/commit/rpms!389-ds-base.git/309aa9ee631432d72c845f70df2ce6475055423b

Whiteboard: (none) => MGA5TOO, MGA4TOO

Comment 2 Thomas Spuhler 2015-04-30 18:04:30 CEST
I upgraded it to version 3.3.3.10 which fixes this bug, issue CVE-2015-1854.
It's easier to maintain than to apply patches during the lifecycle or mga4 on this package.

The following packages are now in updates testing (and asked for a freeze push in cauldron (mga5) )
389-ds-base-1.3.3.10-1.mga4.src.rpm
389-ds-base-1.3.3.10-1.mga4.x86_64.rpm
lib64389-ds-base0-1.3.3.10-1.mga4.x86_64.rpm
lib64389-ds-base-devel-1.3.3.10-1.mga4.x86_64.rpm
389-ds-base-debuginfo-1.3.3.10-1.mga4.x86_64.rpm
and corresponding i586 packages

Status: NEW => ASSIGNED

Comment 3 David Walser 2015-04-30 23:55:41 CEST
Thanks Thomas!

Package list in Comment 2.

Testing procedure:
https://bugs.mageia.org/show_bug.cgi?id=11720#c7

Advisory:
========================

Updated 389-ds-base packages fix security vulnerability:

A flaw was found in the way Red Hat Directory Server performed
authorization of modrdn operations. An unauthenticated attacker able to
issue an ldapmodrdn call to the directory server could use this flaw to
perform unauthorized modifications of entries in the directory server
(CVE-2015-1854).

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3622
https://rhn.redhat.com/errata/RHSA-2015-0895.html

CC: (none) => thomas
Version: Cauldron => 4
Assignee: thomas => qa-bugs
Whiteboard: MGA5TOO, MGA4TOO => has_procedure

Comment 4 Shlomi Fish 2015-05-02 17:56:45 CEST
Tested on a MGA-x86-64 VM and it works fine.

CC: (none) => shlomif
Whiteboard: has_procedure => MGA4-64-OK has_procedure

Comment 5 Shlomi Fish 2015-05-02 18:03:26 CEST
MGA4-32-OKing it because I tested it on an i586 VM and it's OK.

Whiteboard: MGA4-64-OK has_procedure => MGA4-64-OK has_procedure MGA4-32-OK

Comment 6 claire robinson 2015-05-02 19:50:57 CEST
Thanks Shlomi

Validating. Advisory uploaded.

Please push to 4 updates

Thanks!

Keywords: (none) => validated_update
Whiteboard: MGA4-64-OK has_procedure MGA4-32-OK => MGA4-64-OK has_procedure advisory MGA4-32-OK
CC: (none) => sysadmin-bugs

Comment 7 Mageia Robot 2015-05-03 02:20:22 CEST
An update for this issue has been pushed to Mageia Updates repository.

http://advisories.mageia.org/MGASA-2015-0183.html

Status: ASSIGNED => RESOLVED
Resolution: (none) => FIXED