Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:31956
HistoryMay 04, 2015 - 12:00 a.m.

[ MDVSA-2015:225 ] cherokee

2015-05-0400:00:00
vulners.com
11

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Mandriva Linux Security Advisory MDVSA-2015:225
http://www.mandriva.com/en/support/security/


Package : cherokee
Date : May 4, 2015
Affected: Business Server 1.0


Problem Description:

Updated cherokee packages fix security vulnerability:

The cherokee_validator_ldap_check function in validator_ldap.c in
Cherokee 1.2.103 and earlier, when LDAP is used, does not properly
consider unauthenticated-bind semantics, which allows remote attackers
to bypass authentication via an empty password (CVE-2014-4668).


References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4668
http://advisories.mageia.org/MGASA-2015-0181.html


Updated Packages:

Mandriva Business Server 1/X86_64:
da0714c2694349901f329b7be76cb17f mbs1/x86_64/cget-1.2.101-8.1.mbs1.x86_64.rpm
387a32522ce8dd469d8f6689f1ad8b17 mbs1/x86_64/cherokee-1.2.101-8.1.mbs1.x86_64.rpm
4e4d4cf5c6fa797bcd95223f3ad396a8 mbs1/x86_64/cherokee-devel-1.2.101-8.1.mbs1.x86_64.rpm
5c1c910636c338173bc7df734811ad72 mbs1/x86_64/lib64cherokee-base0-1.2.101-8.1.mbs1.x86_64.rpm
0e94af76b87329e56783b01e26cf7cfb mbs1/x86_64/lib64cherokee-client0-1.2.101-8.1.mbs1.x86_64.rpm
f6e55ca4dd2f0c7350380d0af98d4c82 mbs1/x86_64/lib64cherokee-server0-1.2.101-8.1.mbs1.x86_64.rpm
2bd3ca3626fe3cc446d006160bcfeb84 mbs1/SRPMS/cherokee-1.2.101-8.1.mbs1.src.rpm


To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com


Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFVR5lkmqjQ0CJFipgRAkz/AJ92e0TE8pG5hAa4+jcOUOeOMjxGxwCfQvqP
XKs0Xx65F8w1nnYDBZ57Gps=
=Zi00
-----END PGP SIGNATURE-----