PAM_LDAP And Squid_Auth_LDAP Logging Format String Vulnerabilities

Solution:
Red Hat has released a new advisory RHSA-2002:175-16 which obsoletes RHSA-2002:084. Updated nss_ldap RPMs are available. See the attached advisories for details on obtaining fixes.

The SCO Group has released an advisory for OpenLinux. Updated pam_ldap RPMs available.

Gentoo has released a security advisory detailing steps to fix vulnerable systems. Gentoo users are advised to perform the following actions:

emerge rsync
emerge pam_ldap
emerge clean

Mandrake has released an advisory (MDKSA-2002:075) containing upgrades which address this issue. Mandrake users should see the attached advisory for details on obtaining fixes.

Fixes available:


Padl Software pam_ldap Build 143

Padl Software nss_ldap Build 107

Padl Software nss_ldap Build 189

Padl Software nss_ldap Build 122

Padl Software nss_ldap Build 172

Padl Software nss_ldap Build 194

Padl Software nss_ldap Build 173


 

Privacy Statement
Copyright 2010, SecurityFocus