Security Advisory Critical: Red Hat Directory Server 7.1 Service Pack 7 security update

Advisory: RHSA-2008:0596-19
Type: Security Advisory
Severity: Critical
Issued on: 2008-08-27
Last updated on: 2008-10-06
Affected Products: Red Hat Directory Server v7.1
CVEs ( CVE-2008-2928


An updated redhat-ds package that fixes various security issues is now
available as Red Hat Directory Server 7.1, Service Pack 7.

This update has been rated as having critical security impact by the Red
Hat Security Response Team.

Red Hat Directory Server is an LDAPv3-compliant directory server.

Multiple CGI applications distributed with Red Hat Directory Server were
affected by a buffer overflow flaw in the routine used to parse
Accept-Language HTTP headers. A remote attacker with access to the
Administration Server web interface could use this flaw to crash these CGI
applications or, potentially, execute arbitrary code with the privileges of
the Administration Server. Note: Red Hat Directory Server 7.1 runs the
Administration Server as the root user. (CVE-2008-2928)

Multiple cross-site scripting flaws were discovered in the Directory Server
Administration Express and Directory Server Gateway (DSGW) web interface,
caused by an incorrect parsing of "%" character-escaped user-provided
values. A remote attacker could use these flaws to conduct cross-site
scripting attacks against Directory Server users or administrators using
these web services. (CVE-2008-2929)

Multiple memory leaks were identified in the Directory Server. An
unauthenticated remote attacker could use these flaws to trigger high
memory consumption in the Directory Server, possibly causing it to crash or
terminate unexpectedly when running out of available memory. (CVE-2008-3283)

[Updated 5th October 2008]
Ulf Weltman of Hewlett Packard discovered a flaw in the way Directory
Server handled LDAP search requests with patterns. A remote attacker with
access to the LDAP service could create a search request that, when the
search pattern was matched against specially crafted data records, caused
Directory Server to use a large amount of CPU time because the Directory
Server did not impose time limits on such search requests. In this updated
package, Directory Server imposes the nsslapd-timelimit attribute on the
pattern-search query run times. This attribute has the default limit of
3600 seconds; to shorten this limit, use ldapmodify to change the
nsslapd-timelimit value in the cn=config entry. (CVE-2008-2930)

In addition to these security fixes, the following bugs have been fixed in
Red Hat Directory Server 7.1, Service Pack 7:

* A modified accountUnlockTime attribute caused by multiple single-user
login failures caused replication to fail, requiring administrator
intervention. Red Hat Directory Server 7.1 Service Pack 7 solves the
replication failure issue in these situations.

* The change sequence numbers in multi-master replication had a built-in
time skew to accommodate differences in the clocks on master servers. Under
certain circumstances, this skew exceeded the maximum allowable skew,
causing replication to stop entirely. In Service Pack 7, this has been fixed.

* In replication scenarios, if an attribute value was scheduled to be
deleted and also was indexed or had an attribute subtype which was indexed,
the Directory Server would crash during the index operation.

* The stack memory size limit used on 64-bit systems was limited to 256KB.
Directory Server could use all the stack memory while performing regular
operations, resulting in slapd daemon crash.

For more information about Service Pack 7, including upgrade and
installation instructions for users running Red Hat Directory Server 7.1 on
Solaris, refer to the Red Hat Directory Server 7.1 SP7 release notes, which
are linked to in the "References" section of this erratum.

All users of Red Hat Directory Server 7.1 should upgrade to Service Pack 7,
which resolves these issues.


This update is available via Red Hat Network.

Users running Red Hat Directory Server 7.1 on Red Hat Enterprise Linux
should consult the following Knowledge Base article for instruction on how
to install updated RPM packages:

Users running Red Hat Directory Server 7.1 on Solaris should consult the
Service Pack 7 release notes for installation and upgrade instructions.
These release notes are linked to in the "References" section of this erratum.

Updated packages

Red Hat Directory Server v7.1

redhat-ds-7.1SP7-14.RHEL3.src.rpm     MD5: 3e33eeb697e722f541e9b54edd66a771
redhat-ds-7.1SP7-14.RHEL4.src.rpm     MD5: 44b9cca579016dba59cea284f9a8f9de
redhat-ds-7.1SP7-14.RHEL3.i386.rpm     MD5: 20fe4afe804e9032c3439e4c150dba09
redhat-ds-7.1SP7-14.RHEL4.i386.rpm     MD5: 163a99520d7fb822de26c7ebd0d90a5f
(The unlinked packages above are only available from the Red Hat Network)

Bugs fixed (see bugzilla for more information)

453916 - CVE-2008-2928 Directory Server: CGI accept language buffer overflow
454065 - CVE-2008-2930 Directory Server: temporary DoS via crafted pattern searches
454621 - CVE-2008-2929 Directory Server: multiple XSS issues
458977 - CVE-2008-3283 Directory Server: multiple memory leaks


These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:

The Red Hat security contact is More contact details at