A flaw was found in a Accept Language HTTP header parsers implemented in
adminutil library used by various Red Hat Directory Server's Administration
Server's CGI scripts. A remote attacker able to connect to Administration
Server web interface could cause a CGI scripts to crash, or possibly execute an
- Red Hat Directory Server 7.1
- adminutil packages shipped in Red Hat Directory Server 8 and Fedora Directory
Server, prior to adminutil version 1.1.7
Further investigation showed that even though adminutil as shipped with Red Hat
Directory Server 8 contain vulnerable code, it is not used by any CGI script
shipped with Directory Server 8.
Directory Administration Server CGI scripts do not use affected code. Directory
Server Gateway (DSGW), which is affected on Red Hat Directory Server 7.1 and
Fedora Directory Server (fedora-ds-dsgw package), is not shipped with Red Hat
Directory Server 8.
Due to that, this issue will not be treated as security sensitive for Red Hat
Directory Server 8, but may be fixed as bugfix in future adminutil package updates.
adminutil-1.1.7-1.fc8 has been pushed to the Fedora 8 stable repository. If problems still persist, please make note of it in this bug report.
adminutil-1.1.7-1.fc9 has been pushed to the Fedora 9 stable repository. If problems still persist, please make note of it in this bug report.