USN-152-1: PAM/NSS LDAP vulnerabilities

A PAM/NSS LDAP update has been released for Ubuntu Linux

==========================================================
Ubuntu Security Notice USN-152-1 July 21, 2005
openldap2, libpam-ldap, libnss-ldap vulnerabilities
CAN-2005-2069
==========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 4.10 (Warty Warthog)
Ubuntu 5.04 (Hoary Hedgehog)

The following packages are affected:

libnss-ldap
libpam-ldap
slapd

On Ubuntu 4.10, the problem can be corrected by upgrading the affected packages to version 2.1.30-2ubuntu4.1 (slapd), 164-2ubuntu0.1 (libpam-ldap), and 220-1ubuntu0.1 (libnss-ldap).

On Ubuntu 5.04, the problem can be corrected by upgrading the affected packages to version 2.1.30-3ubuntu3.1 (slapd), 169-1ubuntu0.1 (libpam-ldap), and 220-1ubuntu0.1 (libnss-ldap).

In general, a standard system upgrade is sufficient to effect the necessary changes.

(Please note that libnss-ldap and libpam-ldap are not officially supported by Ubuntu, they are in the "universe" suite of the archive.)

Details follow:

Andrea Barisani discovered a flaw in the SSL handling of pam-ldap and libnss-ldap. When a client connected to a slave LDAP server using SSL, the slave server did not use SSL as well when contacting the LDAP master server. This caused passwords and other confident information to be transmitted unencrypted between the slave and the master.


Updated packages for Ubuntu 4.10 (Warty Warthog):

Source archives:

http://security.ubuntu.com/ubuntu/pool/universe/libn/libnss-ldap/libnss-ldap_211-4ubuntu0.1.diff.gz
Size/MD5: 40012 180bfdaf8ddf765fbffd5a671c2e08e5
http://security.ubuntu.com/ubuntu/pool/universe/libn/libnss-ldap/libnss-ldap_211-4ubuntu0.1.dsc
Size/MD5: 687 6b1c2784a1033e5ec81903976c950331
http://security.ubuntu.com/ubuntu/pool/universe/libn/libnss-ldap/libnss-ldap_211.orig.tar.gz
Size/MD5: 221013 34adcab5d46a436617ae686cc7c5e78f
http://security.ubuntu.com/ubuntu/pool/universe/libp/libpam-ldap/libpam-ldap_164-2ubuntu0.1.diff.gz
Size/MD5: 31544 8d085bc008fe5ac70b2a0ad6d56f92f8
http://security.ubuntu.com/ubuntu/pool/universe/libp/libpam-ldap/libpam-ldap_164-2ubuntu0.1.dsc
Size/MD5: 678 da1e9384d50f7b968adf547d829b7315
http://security.ubuntu.com/ubuntu/pool/universe/libp/libpam-ldap/libpam-ldap_164.orig.tar.gz
Size/MD5: 116873 0b5d6ef6735480210d27a3d969f59e12
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/openldap2_2.1.30-2ubuntu4.1.diff.gz
Size/MD5: 116650 89863ef77edba510914cfdad0d3348ef
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/openldap2_2.1.30-2ubuntu4.1.dsc
Size/MD5: 971 a430e9d325011aa5707b511f64d239dd
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/openldap2_2.1.30.orig.tar.gz
Size/MD5: 2044673 e2ae8148c4bed07d7a70edd930bdc403

Architecture independent packages:

http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/libslapd2-dev_2.1.30-2ubuntu4.1_all.deb
Size/MD5: 71854 f2b7772fa613690daa5eb85afcd13a34

amd64 architecture (Athlon64, Opteron, EM64T Xeon)

http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/ldap-utils_2.1.30-2ubuntu4.1_amd64.deb
Size/MD5: 125906 79af7aa37ff71b874214b90ee9ecae1e
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/libldap2-dev_2.1.30-2ubuntu4.1_amd64.deb
Size/MD5: 360024 986821f16397c44875c6f9631e376620
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/libldap2_2.1.30-2ubuntu4.1_amd64.deb
Size/MD5: 308242 d4047e25be22bcf3064f3401d3827a4f
http://security.ubuntu.com/ubuntu/pool/universe/libn/libnss-ldap/libnss-ldap_211-4ubuntu0.1_amd64.deb
Size/MD5: 69096 4dce5370da2e0f675d274801f993ac05
http://security.ubuntu.com/ubuntu/pool/universe/libp/libpam-ldap/libpam-ldap_164-2ubuntu0.1_amd64.deb
Size/MD5: 49546 bdda10f11dae5c0eb89aae5dcb58f17d
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/slapd_2.1.30-2ubuntu4.1_amd64.deb
Size/MD5: 1000922 d0cccba6c649de288204b677c051763c

i386 architecture (x86 compatible Intel/AMD)

http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/ldap-utils_2.1.30-2ubuntu4.1_i386.deb
Size/MD5: 111448 146b9142a0148940068a0e583c0f05bd
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/libldap2-dev_2.1.30-2ubuntu4.1_i386.deb
Size/MD5: 316880 5828ac19e41a9dfd6f42acc754cb3c5d
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/libldap2_2.1.30-2ubuntu4.1_i386.deb
Size/MD5: 283620 2750618047fc01d8393a773caea6ee4f
http://security.ubuntu.com/ubuntu/pool/universe/libn/libnss-ldap/libnss-ldap_211-4ubuntu0.1_i386.deb
Size/MD5: 67978 a2a3f9a58c2a01b9e03f8f7e28575b80
http://security.ubuntu.com/ubuntu/pool/universe/libp/libpam-ldap/libpam-ldap_164-2ubuntu0.1_i386.deb
Size/MD5: 49208 cd423f7aa2211f49110913d661f9effe
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/slapd_2.1.30-2ubuntu4.1_i386.deb
Size/MD5: 902696 5acca424b573c4359cfd26e41677ce0c

powerpc architecture (Apple Macintosh G3/G4/G5)

http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/ldap-utils_2.1.30-2ubuntu4.1_powerpc.deb
Size/MD5: 127948 1a88da127a39484da2c2d0fb782ae0ac
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/libldap2-dev_2.1.30-2ubuntu4.1_powerpc.deb
Size/MD5: 371714 e3579e3bedba4e79e4817178aae191de
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/libldap2_2.1.30-2ubuntu4.1_powerpc.deb
Size/MD5: 301834 207ffdaf7d6a59efeed541c1186826be
http://security.ubuntu.com/ubuntu/pool/universe/libn/libnss-ldap/libnss-ldap_211-4ubuntu0.1_powerpc.deb
Size/MD5: 70402 4dd21e0f29aacf85c3e8caef7ac04ccb
http://security.ubuntu.com/ubuntu/pool/universe/libp/libpam-ldap/libpam-ldap_164-2ubuntu0.1_powerpc.deb
Size/MD5: 49762 c10ceae89d679444cab7d150d709d09c
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/slapd_2.1.30-2ubuntu4.1_powerpc.deb
Size/MD5: 975904 b3c3f67196e71eb563e501f55bc97dd8

Updated packages for Ubuntu 5.04 (Hoary Hedgehog):

Source archives:

http://security.ubuntu.com/ubuntu/pool/universe/libn/libnss-ldap/libnss-ldap_220-1ubuntu0.1.diff.gz
Size/MD5: 26873 59ccd69249e345d2f535a4b6bdf323dd
http://security.ubuntu.com/ubuntu/pool/universe/libn/libnss-ldap/libnss-ldap_220-1ubuntu0.1.dsc
Size/MD5: 687 660f621b904c8cc6db16a1027bca370c
http://security.ubuntu.com/ubuntu/pool/universe/libn/libnss-ldap/libnss-ldap_220.orig.tar.gz
Size/MD5: 204826 d401485fcabf4ea40d244c2c9a19247e
http://security.ubuntu.com/ubuntu/pool/universe/libp/libpam-ldap/libpam-ldap_169-1ubuntu0.1.diff.gz
Size/MD5: 26203 f6618a137174a52f3eaa2c6dc357b434
http://security.ubuntu.com/ubuntu/pool/universe/libp/libpam-ldap/libpam-ldap_169-1ubuntu0.1.dsc
Size/MD5: 678 ba2b65635fcc64aefc6a12c2c90b3bd0
http://security.ubuntu.com/ubuntu/pool/universe/libp/libpam-ldap/libpam-ldap_169.orig.tar.gz
Size/MD5: 119817 62abfe9c5d62e7d112c12d0e5863129f
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/openldap2_2.1.30-3ubuntu3.1.diff.gz
Size/MD5: 117295 743d542b68dd5d743527ac15500b8b51
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/openldap2_2.1.30-3ubuntu3.1.dsc
Size/MD5: 988 abcae0bb7933a4634c0562c41b17a4d5
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/openldap2_2.1.30.orig.tar.gz
Size/MD5: 2044673 e2ae8148c4bed07d7a70edd930bdc403

Architecture independent packages:

http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/libslapd2-dev_2.1.30-3ubuntu3.1_all.deb
Size/MD5: 72308 60a8341fad6776f7da90291b0c0a41e5

amd64 architecture (Athlon64, Opteron, EM64T Xeon)

http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/ldap-utils_2.1.30-3ubuntu3.1_amd64.deb
Size/MD5: 126282 504170293b367b3d3960c19619386368
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/libldap2-dev_2.1.30-3ubuntu3.1_amd64.deb
Size/MD5: 361172 fc2aaa72ddc00c7ea6e9118d18532672
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/libldap2_2.1.30-3ubuntu3.1_amd64.deb
Size/MD5: 309092 62bb57d16d2e0b7ef505d9023eacc687
http://security.ubuntu.com/ubuntu/pool/universe/libn/libnss-ldap/libnss-ldap_220-1ubuntu0.1_amd64.deb
Size/MD5: 74590 f1087a8146dd42601bbc990f8d1c755d
http://security.ubuntu.com/ubuntu/pool/universe/libp/libpam-ldap/libpam-ldap_169-1ubuntu0.1_amd64.deb
Size/MD5: 52078 6057c9f1597d80a2c162837b25f2e9a7
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/slapd_2.1.30-3ubuntu3.1_amd64.deb
Size/MD5: 1087990 a8a2b8b425be64cb3fcf5a32a8d83416

i386 architecture (x86 compatible Intel/AMD)

http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/ldap-utils_2.1.30-3ubuntu3.1_i386.deb
Size/MD5: 110644 d52d6dd0c45e8532c6170ddf1a52f19c
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/libldap2-dev_2.1.30-3ubuntu3.1_i386.deb
Size/MD5: 317990 4e54bf4ec7dc799de00bf8bf0711bded
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/libldap2_2.1.30-3ubuntu3.1_i386.deb
Size/MD5: 284484 89c8c1a89831713025896642ccccd900
http://security.ubuntu.com/ubuntu/pool/universe/libn/libnss-ldap/libnss-ldap_220-1ubuntu0.1_i386.deb
Size/MD5: 73536 ed6ee791428191886b86d29063997565
http://security.ubuntu.com/ubuntu/pool/universe/libp/libpam-ldap/libpam-ldap_169-1ubuntu0.1_i386.deb
Size/MD5: 51670 384be799688e0277feb86b4508288699
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/slapd_2.1.30-3ubuntu3.1_i386.deb
Size/MD5: 979238 3e2fad1ffb1b9d7eac366467da98e3ce

powerpc architecture (Apple Macintosh G3/G4/G5)

http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/ldap-utils_2.1.30-3ubuntu3.1_powerpc.deb
Size/MD5: 129544 bb935cbb6fc5e7670646607d0c481ff6
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/libldap2-dev_2.1.30-3ubuntu3.1_powerpc.deb
Size/MD5: 373102 fbd4736d7f2167db5a204609f08076e6
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/libldap2_2.1.30-3ubuntu3.1_powerpc.deb
Size/MD5: 302728 8e97eb53df941a8d4546f3de39477aa7
http://security.ubuntu.com/ubuntu/pool/universe/libn/libnss-ldap/libnss-ldap_220-1ubuntu0.1_powerpc.deb
Size/MD5: 75784 8d77afd6f2a602294cc1d953b9995c38
http://security.ubuntu.com/ubuntu/pool/universe/libp/libpam-ldap/libpam-ldap_169-1ubuntu0.1_powerpc.deb
Size/MD5: 52180 40ef599a113e873a235b76f315a444d2
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2/slapd_2.1.30-3ubuntu3.1_powerpc.deb
Size/MD5: 1058104 59a515083487c2218c4acefb99bee97d