diff options
| author | sat <sat@FreeBSD.org> | 2006-10-05 22:31:50 +0800 |
|---|---|---|
| committer | sat <sat@FreeBSD.org> | 2006-10-05 22:31:50 +0800 |
| commit | bb77e0fa478a5adb489054bd86f94ee1388a6bf8 (patch) | |
| tree | 06bfe09eeb52f000a3f0d992c5e39bc6118abde3 /security | |
| parent | dd15a3589233958e283157f4b8f47d9a5aafd8ab (diff) | |
| download | freebsd-ports-gnome-bb77e0fa478a5adb489054bd86f94ee1388a6bf8.tar.gz freebsd-ports-gnome-bb77e0fa478a5adb489054bd86f94ee1388a6bf8.tar.zst freebsd-ports-gnome-bb77e0fa478a5adb489054bd86f94ee1388a6bf8.zip | |
- Document slapd acl selfwrite Security Issue in openldap
Diffstat (limited to 'security')
| -rw-r--r-- | security/vuxml/vuln.xml | 35 |
1 files changed, 35 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 8dae593d0815..a6717bac185e 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -34,6 +34,41 @@ Note: Please add new entries to the beginning of this file. --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="ae7124ff-547c-11db-8f1a-000a48049292"> + <topic>openldap -- slapd acl selfwrite Security Issue</topic> + <affects> + <package> + <name>openldap-server</name> + <name>openldap-sasl-server</name> + <range><lt>2.3.25</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>Howard Chu reports:</p> + <blockquote cite="http://www.openldap.org/its/index.cgi/Software%20Bugs?id=4587"> + <p>An ACL of the form 'access to dn.subtree="ou=groups, + dc=example,dc=com" attr=member by * selfwrite' is intended + to only allow users to add/delete their own DN to the + target attribute. Currently it allows any DNs to be + modified.</p> + </blockquote> + </body> + </description> + <references> + <bid>19832</bid> + <cvename>CVE-2006-4600</cvename> + <url>http://www.openldap.org/its/index.cgi/Software%20Bugs?id=4587</url> + <url>http://www.openldap.org/lists/openldap-announce/200608/msg00000.html</url> + <url>http://secunia.com/advisories/21721</url> + <url>http://securitytracker.com/alerts/2006/Sep/1016783.html</url> + </references> + <dates> + <discovery>2006-06-14</discovery> + <entry>2006-10-05</entry> + </dates> + </vuln> + <vuln vid="5a39a22e-5478-11db-8f1a-000a48049292"> <topic>mono -- "System.CodeDom.Compiler" Insecure Temporary Creation</topic> <affects> |