Bug 787014 (CVE-2012-0833)

Summary:	CVE-2012-0833 389: denial of service when using certificate groups
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	jgalipea, rmeggins, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:	see https://bugzilla.redhat.com/show_bug.cgi?id=781519	Story Points:	---
Clone Of:
Clones:	890944 (view as bug list)		Environment:
Last Closed:	2015-08-22 06:24:40 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	781519, 890944
Bug Blocks:	784298, 790261

Description Vincent Danen 2012-02-02 22:03:00 UTC

A flaw was found [1] in the way 389 handled certificate groups with authentication.  If a 389 server were configured to use certificate groups, and had an aci that included a certificate group, it would be possible a remote, authenticated user to cause 389 to enter an infinite loop and consume all available CPU, causing it to stop responding to further requests.

This has been resolved in upstream git [2].

[1] https://fedorahosted.org/389/ticket/162
[2] https://fedorahosted.org/389/changeset/1bbbb3e5049c1aa0650546efab87ed2f1ea59637/389-ds-base

Comment 3 Kurt Seifried 2012-02-03 08:51:57 UTC

Corrected CVE typo

Comment 7 Murray McAllister 2012-06-15 12:08:10 UTC

Acknowledgements:

Red Hat would like to thank Graham Leggett for reporting this issue.

Comment 8 errata-xmlrpc 2012-06-20 07:13:12 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2012:0813 https://rhn.redhat.com/errata/RHSA-2012-0813.html

Comment 10 Vincent Danen 2013-02-21 16:14:15 UTC

Statement:

(none)

Comment 11 errata-xmlrpc 2013-02-21 19:04:19 UTC

This issue has been addressed in following products:

  Red Hat Directory Server 8 for RHEL 5

Via RHSA-2013:0549 https://rhn.redhat.com/errata/RHSA-2013-0549.html