PT-2007-1045 · Dovecot+3 · Dovecot+3

Josh Bressers · Published 2007-11-13 · Updated 2018-10-15 · CVE-2007-5794

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: nss ldap versions prior to 258

Description: A race condition in nss ldap might send user data to the wrong process because of improper handling of the LDAP connection. This issue can lead to a breach of confidentiality of protected information and can be exploited remotely. The problem was originally reported in applications linked against the pthread library and fork after a call to nss ldap, such as Dovecot, where it caused the wrong mailboxes to be returned. Other applications might also be affected.

Recommendations: For versions prior to 258, update to version 258 or later to resolve the issue. As a temporary workaround, consider restricting the use of nss ldap in applications that fork after a call to nss ldap to minimize the risk of exploitation.

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

BDU:2015-03680

BDU:2015-09612

CVE-2007-5794

DSA-1430-1

RHSA-2008:0389

RHSA-2008:0715

RHSA-2008_0389

RHSA-2008_0715

Affected Products

Dovecot

Red Hat

Nss Ldap

Thread

References · 40

• https://nvd.nist.gov/vuln/detail/CVE-2007-5794 · Security Note
• http://secunia.com/advisories/31524 · Vendor Advisory
• http://secunia.com/advisories/31227 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2008-0389.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-03680 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5794 · Security Note
• https://bdu.fstec.ru/vul/2015-09612 · Security Note
• http://redhat.com/support/errata/RHSA-2008-0715.html · Vendor Advisory
• http://secunia.com/advisories/30352 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2008:049 · Vendor Advisory
• http://secunia.com/advisories/27839 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200711-33.xml · Vendor Advisory
• http://secunia.com/advisories/27768 · Vendor Advisory
• http://secunia.com/advisories/28061 · Vendor Advisory
• http://securityfocus.com/bid/26452 · Patch