Solution
Please Install the Updated Packages.
Insight
The nss-pam-ldapd packages provide the nss-pam-ldapd daemon (nslcd), which uses a directory server to lookup name service information on behalf of a lightweight nsswitch module.
An array index error, leading to a stack-based buffer overflow flaw, was found in the way nss-pam-ldapd managed open file descriptors. An attacker able to make a process have a large number of open file descriptors and perform name lookups could use this flaw to cause the process to crash or, potentially, execute arbitrary code with the privileges of the user running the process. (CVE-2013-0288)
Red Hat would like to thank Garth Mollett for reporting this issue.
All users of nss-pam-ldapd are advised to upgrade to these updated packages, which contain a backported patch to fix this issue.
Affected
nss-pam-ldapd on Red Hat Enterprise Linux Desktop (v. 6), Red Hat Enterprise Linux Server (v. 6),
Red Hat Enterprise Linux Workstation (v. 6)
References
Updated on 2015-03-25
Severity
Classification
-
CVE CVE-2013-0288 -
CVSS Base Score: 6.8
AV:N/AC:M/Au:N/C:P/I:P/A:P
Related Vulnerabilities