__________________________________________________________ The U.S. Department of Energy Computer Incident Advisory Capability ___ __ __ _ ___ / | /_\ / \___ __|__ / \ \___ __________________________________________________________ INFORMATION BULLETIN redhat-ds-admin Security Update [Red Hat RHSA-2008:0201-4] May 8, 2008 18:00 GMT Number S-285 ______________________________________________________________________________ PROBLEM: Several security vulnerabilities have been discovered in Directory Server: 1) a shell command injection flaw in the Red Hat Administration Server replication monitor CGI script used by Red Hat Directory Server 8.0; and 2) the Red Hat Administration Server does not properly restrict access to CGI scripts. PLATFORM: Red Hat Directory Server 8 EL4 and EL5 DAMAGE: Execute arbitrary shell commands. SOLUTION: Upgrade to the appropriate version. ______________________________________________________________________________ VULNERABILITY The risk is MEDIUM. An attacker with access to the replication ASSESSMENT: monitor web page could execute arbitrary shell commands with the privileges of the Administration Server and an unauthenticated remote user with access to the TCP port used by the Administration Server could access information or perform certain tasks that should have been restricted to Directory Server administrative users. ______________________________________________________________________________ CVSS 2 BASE SCORE: 7.7 TEMPORAL SCORE: 7.7 VECTOR: (AV:A/AC:L/Au:S/C:C/I:C/A:C/E:ND/RL:ND/RC:ND) ______________________________________________________________________________ LINKS: CIAC BULLETIN: http://www.ciac.org/ciac/bulletins/s-285.shtml ORIGINAL BULLETIN: http://rhn.redhat.com/errata/RHSA-2008-0201.html ADDITIONAL LINK: Visit Hewlett-Packard's Subscription Service for: HPSBUX02324 SSRT080034 rev. 1 CVE: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name= CVE-2008-0892 CVE-2008-0893 ______________________________________________________________________________ [***** Start Red Hat RHSA-2008:0201-4 *****] Critical: redhat-ds-admin security update Advisory: RHSA-2008:0201-4 Type: Security Advisory Severity: Critical Issued on: 2008-04-15 Last updated on: 2008-04-15 Affected Products: Directory Server 8 EL4 Directory Server 8 EL5 OVAL: N/A CVEs (cve.mitre.org): CVE-2008-0892 CVE-2008-0893 Details An updated redhat-ds-admin package that fixes security issues is now available for Red Hat Directory Server 8.0. This update has been rated as having critical security impact by the Red Hat Security Response Team. Red Hat Administration Server is an HTTP agent that provides management features for Red Hat Directory Server, an LDAPv3 compliant server. A shell command injection flaw was discovered in the Red Hat Administration Server replication monitor CGI script used by Red Hat Directory Server 8.0. An attacker with access to the replication monitor web page could execute arbitrary shell commands with the privileges of the Administration Server. Please Note: by default, the Red Hat Administration Server is run as the unprivileged user, "nobody". (CVE-2008-0892) It was discovered that the Red Hat Administration Server did to properly restrict access to CGI scripts. An unauthenticated remote user with access to the TCP port used by the Administration Server could access information or perform certain tasks that should have been restricted to Directory Server administrative users. Please note: by default the Red Hat Administration Server uses port 9830, although this can be changed by the Red Hat Directory Server administrator. (CVE-2008-0893) In combination, these two flaws allowed an unauthenticated remote attacker able to access the Red Hat Administration Server TCP port to run arbitrary code as the user "nobody". All users of Red Hat Directory Server should upgrade to this updated package, which addresses these vulnerabilities. Solution Users running Red Hat Directory Server on Red Hat Enterprise Linux: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 Users running Red Hat Directory Server on Solaris: An archive (in .tar.gz format) containing the updated Solaris packages in .pkg format is available in the Red Hat Directory Server 8.0 Solaris channel on the Red Hat Network. This archive also contains a file with further instructions about how to install/upgrade the packages using Solaris native package management tools. Updated packages Directory Server 8 EL4 -------------------------------------------------------------------------------- SRPMS: redhat-ds-admin-8.0.0-6.el4dsrv.src.rpm 2c1f579fc328c51b7294668e5bbe3217 redhat-ds-admin-8.0.0-6.el4dsrv.src.rpm 2c1f579fc328c51b7294668e5bbe3217 IA-32: redhat-ds-admin-8.0.0-6.el4dsrv.i386.rpm 42cd64470ea93f286d520d64faf43fc1 redhat-ds-admin-8.0.0-6.el4dsrv.i386.rpm 42cd64470ea93f286d520d64faf43fc1 x86_64: redhat-ds-admin-8.0.0-6.el4dsrv.x86_64.rpm 5e890b1f90be3af00ef9a936908b850b redhat-ds-admin-8.0.0-6.el4dsrv.x86_64.rpm 5e890b1f90be3af00ef9a936908b850b Directory Server 8 EL5 -------------------------------------------------------------------------------- SRPMS: redhat-ds-admin-8.0.0-6.el5dsrv.src.rpm 728247d62320fcd4e62174f1358d2696 IA-32: redhat-ds-admin-8.0.0-6.el5dsrv.i386.rpm e0d9b908d5c4ded9fe34278bd8858ede x86_64: redhat-ds-admin-8.0.0-6.el5dsrv.x86_64.rpm e6ee1580712b0213d4c6f6370d62b86a (The unlinked packages above are only available from the Red Hat Network) Bugs fixed (see bugzilla for more information) 437301 - CVE-2008-0892 Director Server: shell command injection in CGI replication monitor 437320 - CVE-2008-0893 Directory Server: unrestricted access to CGI scripts References http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0892 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0893 http://www.redhat.com/security/updates/classification/#critical -------------------------------------------------------------------------------- These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from: https://www.redhat.com/security/team/key/#package The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/ [***** End Red Hat RHSA-2008:0201-4 *****] _______________________________________________________________________________ CIAC wishes to acknowledge the contributions of Red Hat for the information contained in this bulletin. _______________________________________________________________________________ CIAC, the Computer Incident Advisory Capability, is the computer security incident response team for the U.S. Department of Energy (DOE) and the emergency backup response team for the National Institutes of Health (NIH). CIAC is located at the Lawrence Livermore National Laboratory in Livermore, California. CIAC is also a founding member of FIRST, the Forum of Incident Response and Security Teams, a global organization established to foster cooperation and coordination among computer security teams worldwide. CIAC services are available to DOE, DOE contractors, and the NIH. CIAC can be contacted at: Voice: +1 925-422-8193 (7x24) FAX: +1 925-423-8002 STU-III: +1 925-423-2604 E-mail: ciac@ciac.org Previous CIAC notices, anti-virus software, and other information are available from the CIAC Computer Security Archive. World Wide Web: http://www.ciac.org/ Anonymous FTP: ftp.ciac.org PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing communities receive CIAC bulletins. If you are not part of these communities, please contact your agency's response team to report incidents. Your agency's team will coordinate with CIAC. The Forum of Incident Response and Security Teams (FIRST) is a world-wide organization. A list of FIRST member organizations and their constituencies can be obtained via WWW at http://www.first.org/. This document was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor the University of California nor any of their employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation or favoring by the United States Government or the University of California. The views and opinions of authors expressed herein do not necessarily state or reflect those of the United States Government or the University of California, and shall not be used for advertising or product endorsement purposes. LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC) S-213: Nukedit 'email' Parameter Vulnerability S-214: SurgeMail and WebMail 'Page' Command Vulnerability S-215: Symantec Backup Exec Scheduler ActiveX Control Multiple Vulnerabilities S-216: Juniper Networks Secure Access 2000 'rdremediate.cgi' Vulnerability S-217: Drupal Multiple HTML Vulnerabilities S-218: gd Security Update S-219: Juniper Networks Secure Access 2000 Web Root Path Vulnerability S-220: PHP-Nuke My_eGallery Module 'gid' Parameter Vulnerability S-221: Learn2 STRunner ActiveX Control Vulnerabilities S-222: Evolution Security Update