Updated openldap packages available for iSeries and pSeries

Updated openldap packages are available which fix a number of local and
remote buffer overflows in libldap, and in the slapd and slurpd servers, as
well as fixing potential issues stemming from using user-specified LDAP
configuration files.

OpenLDAP is a suite of LDAP (Lightweight Directory Access Protocol)
applications and development tools. LDAP is a set of protocols for
accessing directory services. In an audit of OpenLDAP by SuSE, a number of
potential security issues were found:

When reading configuration files, libldap reads the current user's
.ldaprc file -- even in applications running with elevated privileges.

Slurpd overflows an internal buffer if the command line argument used
with the -t or -r flags is too long, or if the name of a file for which it
attempts to create an advisory lock is too long.

When parsing filters, the getfilter family of functions from libldap could
be made to overflow an internal buffer by supplying a carefully crafted
ldapfilter.conf file.

When processing LDAP entry display templates, libldap could be made to
overflow an internal buffer by supplying a properly crafted
ldaptemplates.conf file.

When parsing an access control list, slapd could be made to overflow an
internal buffer.

When constructing the name of the file used for logging rejected
replication requests, slapd overflows an internal buffer if the size
of the generated name is too large, and could be tricked into destroying
the contents of any file owned by the ldap user due to a race condition in
the subsequent creation of the log file.

Red Hat Linux users who use LDAP are advised to install the updated
openldap packages which are not vulnerable to these issues.

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade. Only those
RPMs which are currently installed will be updated. Those RPMs which are
not installed but included in the list will not be updated. Note that you
can also use wildcards (*.rpm) if your current directory *only* contains the
desired RPMs.

Please note that this update is also available via Red Hat Network. Many
people find this an easier way to apply updates. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1378
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1379
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1508

.ldaprc, buffer, openldap, overflow, setuid