Test ID:	1.3.6.1.4.1.25623.1.0.68199
Category:	Ubuntu Local Security Checks
Title:	Ubuntu USN-965-1 (openldap2.3)
Summary:	NOSUMMARY
Description:	Description: The remote host is missing an update to openldap2.3 announced via advisory USN-965-1. Details follow: Using the Codenomicon LDAPv3 test suite, Ilkka Mattila and Tuomas Salomäki discovered that the slap_modrdn2mods function in modrdn.c in OpenLDAP does not check the return value from a call to the smr_normalize function. A remote attacker could use specially crafted modrdn requests to crash the slapd daemon or possibly execute arbitrary code. (CVE-2010-0211) Using the Codenomicon LDAPv3 test suite, Ilkka Mattila and Tuomas Salomäki discovered that OpenLDAP does not properly handle empty RDN strings. A remote attacker could use specially crafted modrdn requests to crash the slapd daemon. (CVE-2010-0212) In the default installation under Ubuntu 8.04 LTS and later, attackers would be isolated by the OpenLDAP AppArmor profile for the slapd daemon. Solution: The problem can be corrected by upgrading your system to the following package versions: Ubuntu 6.06 LTS: slapd 2.2.26-5ubuntu2.10 Ubuntu 8.04 LTS: slapd 2.4.9-0ubuntu0.8.04.4 Ubuntu 9.04: slapd 2.4.15-1ubuntu3.1 Ubuntu 9.10: slapd 2.4.18-0ubuntu1.1 Ubuntu 10.04 LTS: slapd 2.4.21-0ubuntu5.2 In general, a standard system update will make all the necessary changes. http://www.securityspace.com/smysecure/catid.html?in=USN-965-1 Risk factor : Medium CVSS Score: 5.0
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2010-0211 http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html BugTraq ID: 41770 http://www.securityfocus.com/bid/41770 Bugtraq: 20110105 VMSA-2011-0001 VMware ESX third party updates for Service Console packages glibc, sudo, and openldap (Google Search) http://www.securityfocus.com/archive/1/515545/100/0/threaded http://security.gentoo.org/glsa/glsa-201406-36.xml http://www.redhat.com/support/errata/RHSA-2010-0542.html http://www.redhat.com/support/errata/RHSA-2010-0543.html http://www.securitytracker.com/id?1024221 http://secunia.com/advisories/40639 http://secunia.com/advisories/40677 http://secunia.com/advisories/40687 http://secunia.com/advisories/42787 SuSE Security Announcement: SUSE-SR:2010:014 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html http://www.vupen.com/english/advisories/2010/1849 http://www.vupen.com/english/advisories/2010/1858 http://www.vupen.com/english/advisories/2011/0025 Common Vulnerability Exposure (CVE) ID: CVE-2010-0212
Copyright	Copyright (c) 2010 E-Soft Inc. http://www.securityspace.com

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.