Executive Summary

Summary
Title nss-pam-ldapd update
Informations
Name DSA-2628 First vendor Publication 2013-02-18
Vendor Debian Last vendor Modification 2013-06-18
Severity (Vendor) N/A Revision 2

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Cvss Base Score 6.8 Attack Range Network
Cvss Impact Score 6.4 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

The security update DSA-2628 for nss-pam-ldapd failed to build on kfreebsd-amd64 and kfreebsd-i386.

For the oldstable distribution (squeeze) this problem has been fixed in version 0.7.15+squeeze4.

We recommend that you upgrade your nss-pam-ldapd packages.

Original Source

Url : http://www.debian.org/security/2013/dsa-2628

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:20062
 
Oval ID: oval:org.mitre.oval:def:20062
Title: DSA-2628-1 nss-pam-ldapd - buffer overflow
Description: Garth Mollett discovered that a file descriptor overflow issue in the use of FD_SET() in nss-pam-ldapd, which provides NSS and PAM modules for using LDAP as a naming service, can lead to a stack-based buffer overflow. An attacker could, under some circumstances, use this flaw to cause a process that has the NSS or PAM module loaded to crash or potentially execute arbitrary code.
Family: unix Class: patch
Reference(s): DSA-2628-1
CVE-2013-0288
 Version: 7
Platform(s): Debian GNU/Linux 6.0
Debian GNU/kFreeBSD 6.0
 Product(s): nss-pam-ldapd
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:21059
 
Oval ID: oval:org.mitre.oval:def:21059
Title: RHSA-2013:0590: nss-pam-ldapd security update (Important)
Description: nss-pam-ldapd before 0.7.18 and 0.8.x before 0.8.11 allows context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code by performing a name lookup on an application with a large number of open file descriptors, which triggers a stack-based buffer overflow related to incorrect use of the FD_SET macro.
Family: unix Class: patch
Reference(s): RHSA-2013:0590-01
CESA-2013:0590
CVE-2013-0288
 Version: 4
Platform(s): Red Hat Enterprise Linux 6
CentOS Linux 6
 Product(s): nss-pam-ldapd
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23577
 
Oval ID: oval:org.mitre.oval:def:23577
Title: ELSA-2013:0590: nss-pam-ldapd security update (Important)
Description: nss-pam-ldapd before 0.7.18 and 0.8.x before 0.8.11 allows context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code by performing a name lookup on an application with a large number of open file descriptors, which triggers a stack-based buffer overflow related to incorrect use of the FD_SET macro.
Family: unix Class: patch
Reference(s): ELSA-2013:0590-01
CVE-2013-0288
 Version: 6
Platform(s): Oracle Linux 6
 Product(s): nss-pam-ldapd
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27574
 
Oval ID: oval:org.mitre.oval:def:27574
Title: DEPRECATED: ELSA-2013-0590 -- nss-pam-ldapd security update (important)
Description: [0.7.5-18.1] - Apply upstream r1926 to resolve FD_SET array index error - Resolves: rhbz#915361
Family: unix Class: patch
Reference(s): ELSA-2013-0590
CVE-2013-0288
 Version: 4
Platform(s): Oracle Linux 6
 Product(s): nss-pam-ldapd
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:29194
 
Oval ID: oval:org.mitre.oval:def:29194
Title: DSA-2628-2 -- nss-pam-ldapd -- buffer overflow
Description: Garth Mollett discovered that a file descriptor overflow issue in the use of FD_SETin nss-pam-ldapd, which provides NSS and PAM modules for using LDAP as a naming service, can lead to a stack-based buffer overflow. An attacker could, under some circumstances, use this flaw to cause a process that has the NSS or PAM module loaded to crash or potentially execute arbitrary code.
Family: unix Class: patch
Reference(s): DSA-2628-2
CVE-2013-0288
 Version: 3
Platform(s): Debian GNU/Linux 6.0
Debian GNU/kFreeBSD 6.0
 Product(s): nss-pam-ldapd
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 51

Nessus® Vulnerability Scanner

Date Description
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2013-240.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing a security update.
File : oraclelinux_ELSA-2013-0590.nasl - Type : ACT_GATHER_INFO
2013-04-20 Name : The remote Mandriva Linux host is missing a security update.
File : mandriva_MDVSA-2013-106.nasl - Type : ACT_GATHER_INFO
2013-03-10 Name : The remote CentOS host is missing a security update.
File : centos_RHSA-2013-0590.nasl - Type : ACT_GATHER_INFO
2013-03-05 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2013-0590.nasl - Type : ACT_GATHER_INFO
2013-03-05 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20130304_nss_pam_ldapd_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2013-03-01 Name : The remote Fedora host is missing a security update.
File : fedora_2013-2754.nasl - Type : ACT_GATHER_INFO
2013-02-21 Name : The remote FreeBSD host is missing a security-related update.
File : freebsd_pkg_58c152927b6111e295da001e8c1a8a0e.nasl - Type : ACT_GATHER_INFO
2013-02-19 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2628.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
Date Informations
2014-02-17 11:31:40
  • Multiple Updates
2013-06-19 00:18:24
  • Multiple Updates
2013-03-06 17:20:11
  • Multiple Updates
2013-03-06 13:20:01
  • Multiple Updates
2013-02-18 21:19:45
  • First insertion