[Security Announce] [ MDVSA-2015:225 ] cherokee

Fabricante: Mandriva
Fecha: 04/05/2015
Identificador: MDVSA-2015:225
[Security Announce] [ MDVSA-2015:225 ] cherokee
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2015:225 http://www.mandriva.com/en/support/security/ _______________________________________________________________________ Package : cherokee Date : May 4, 2015 Affected: Business Server 1.0 _______________________________________________________________________ Problem Description: Updated cherokee packages fix security vulnerability: The cherokee_validator_ldap_check function in validator_ldap.c in Cherokee 1.2.103 and earlier, when LDAP is used, does not properly consider unauthenticated-bind semantics, which allows remote attackers to bypass authentication via an empty password (CVE-2014-4668). _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4668 http://advisories.mageia.org/MGASA-2015-0181.html _______________________________________________________________________ Updated Packages: Mandriva Business Server 1/X86_64: da0714c2694349901f329b7be76cb17f mbs1/x86_64/cget-1.2.101-8.1.mbs1.x86_64.rpm 387a32522ce8dd469d8f6689f1ad8b17 mbs1/x86_64/cherokee-1.2.101-8.1.mbs1.x86_64.rpm 4e4d4cf5c6fa797bcd95223f3ad396a8 mbs1/x86_64/cherokee-devel-1.2.101-8.1.mbs1.x86_64.rpm 5c1c910636c338173bc7df734811ad72 mbs1/x86_64/lib64cherokee-base0-1.2.101-8.1.mbs1.x86_64.rpm 0e94af76b87329e56783b01e26cf7cfb mbs1/x86_64/lib64cherokee-client0-1.2.101-8.1.mbs1.x86_64.rpm f6e55ca4dd2f0c7350380d0af98d4c82 mbs1/x86_64/lib64cherokee-server0-1.2.101-8.1.mbs1.x86_64.rpm 2bd3ca3626fe3cc446d006160bcfeb84 mbs1/SRPMS/cherokee-1.2.101-8.1.mbs1.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/en/support/security/advisories/ If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iD8DBQFVR5lkmqjQ0CJFipgRAkz/AJ92e0TE8pG5hAa4+jcOUOeOMjxGxwCfQvqP XKs0Xx65F8w1nnYDBZ57Gps= =Zi00 -----END PGP SIGNATURE-----