National Cyber Awareness System

Vulnerability Summary for CVE-2007-5794

Overview

Race condition in nss_ldap, when used in applications that are linked against the pthread library and fork after a call to nss_ldap, might send user data to the wrong process because of improper handling of the LDAP connection. NOTE: this issue was originally reported for Dovecot with the wrong mailboxes being returned, but other applications might also be affected.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: BID

Name: 26452

Type: Patch Information

Hyperlink:http://www.securityfocus.com/bid/26452

External Source: CONFIRM

Name: https://issues.rpath.com/browse/RPL-1913

Hyperlink:https://issues.rpath.com/browse/RPL-1913

External Source: CONFIRM

Name: https://bugzilla.redhat.com/show_bug.cgi?id=367461

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=367461

External Source: CONFIRM

Name: https://bugzilla.redhat.com/show_bug.cgi?id=154314

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=154314

External Source: XF

Name: nssldap-ldap-race-condition(38505)

Hyperlink:http://xforce.iss.net/xforce/xfdb/38505

External Source: SECTRACK

Name: 1020088

Hyperlink:http://www.securitytracker.com/id?1020088

External Source: BUGTRAQ

Name: 20080212 FLEA-2008-0003-1 nss_ldap

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/487985/100/0/threaded

External Source: REDHAT

Name: RHSA-2008:0715

Hyperlink:http://www.redhat.com/support/errata/RHSA-2008-0715.html

External Source: REDHAT

Name: RHSA-2008:0389

Hyperlink:http://www.redhat.com/support/errata/RHSA-2008-0389.html

External Source: MANDRIVA

Name: MDVSA-2008:049

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2008:049

External Source: MLIST

Name: [Dovecot] 20050303 hanging imap... and users getting other users' emails!

Hyperlink:http://www.dovecot.org/list/dovecot/2005-March/006345.html

External Source: MLIST

Name: [Dovecot] 20050409 Authentication and the wrong mailbox?

Hyperlink:http://www.dovecot.org/list/dovecot/2005-April/006859.html

External Source: DEBIAN

Name: DSA-1430

Hyperlink:http://www.debian.org/security/2007/dsa-1430

External Source: CONFIRM

Name: http://wiki.rpath.com/wiki/Advisories:rPSA-2007-0255

Hyperlink:http://wiki.rpath.com/wiki/Advisories:rPSA-2007-0255

External Source: CONFIRM

Name: http://support.avaya.com/elmodocs2/security/ASA-2008-332.htm

Hyperlink:http://support.avaya.com/elmodocs2/security/ASA-2008-332.htm

External Source: GENTOO

Name: GLSA-200711-33

Hyperlink:http://security.gentoo.org/glsa/glsa-200711-33.xml

External Source: SECUNIA

Name: 31524

Type: Advisory

Hyperlink:http://secunia.com/advisories/31524

External Source: SECUNIA

Name: 31227

Type: Advisory

Hyperlink:http://secunia.com/advisories/31227

External Source: SECUNIA

Name: 30352

Type: Advisory

Hyperlink:http://secunia.com/advisories/30352

External Source: SECUNIA

Name: 29083

Type: Advisory

Hyperlink:http://secunia.com/advisories/29083

External Source: SECUNIA

Name: 28838

Type: Advisory

Hyperlink:http://secunia.com/advisories/28838

External Source: SECUNIA

Name: 28061

Type: Advisory

Hyperlink:http://secunia.com/advisories/28061

External Source: SECUNIA

Name: 27839

Type: Advisory

Hyperlink:http://secunia.com/advisories/27839

External Source: SECUNIA

Name: 27768

Type: Advisory

Hyperlink:http://secunia.com/advisories/27768

External Source: SECUNIA

Name: 27670

Type: Advisory

Hyperlink:http://secunia.com/advisories/27670

External Source: OVAL

Name: oval:org.mitre.oval:def:10625

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10625

External Source: SUSE

Name: SUSE-SR:2008:003

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00003.html

External Source: CONFIRM

Name: http://bugs.gentoo.org/show_bug.cgi?id=198390

Hyperlink:http://bugs.gentoo.org/show_bug.cgi?id=198390

External Source: CONFIRM

Name: http://bugs.gentoo.org/show_bug.cgi?id=198390

Hyperlink:http://bugs.gentoo.org/show_bug.cgi?id=198390

External Source: CONFIRM

Name: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=453868

Hyperlink:http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=453868

References to Check Content

Identifier:oval:org.mitre.oval:def:10625

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:10625