Monday Apr 28, 2008

Security Vulnerability in Sun Java System Directory Proxy Server 6.2

Please see original security alert notification at http://sunsolve.sun.com/search/document.do?assetkey=1-66-235381-1

 

Document Audience:

PUBLIC
Document ID:235381
Title:Security Vulnerability in Sun Java System Directory Proxy Server May Grant Unauthorized Administrative Access
Copyright Notice:Copyright © 2008 Sun Microsystems, Inc. All Rights Reserved
Update Date:Fri Apr 25 00:00:00 MDT 2008

Solution Type Sun Alert

Solution  235381 :   Security Vulnerability in Sun Java System Directory Proxy Server May Grant Unauthorized Administrative Access  


Related Categories
  • Home>Content>Sun Alert Criteria Categories>Security
  •  
  • Home>Content>Sun Alert Release Phase>Resolved
  •  

Bug ID
6666615

Product
Sun Java System Directory Server 6.0, 6.1, 6.2, Enterprise Edition

Date of Resolved Release
25-Apr-2008

SA Document Body
Security Vulnerability in Sun Java System Directory Proxy Server 
May Grant Unauthorized Administrative Access

1. Impact

A security vulnerability in the Sun Java System Directory Proxy Server may allow a remote unprivileged user to gain unauthorized administrative access to the server. This is caused by the server incorrectly classifying a connection based on the "bind-dn" criteria, resulting in an incorrect policy being applied.

2. Contributing Factors

This issue can occur in the following releases for all platforms (Solaris 8, 9, and 10 SPARC and x86 Platforms, Linux, Windows, and HP-UX):
  • Directory Server Enterprise Edition 6.0, 6.1 and 6.2
Note: Directory Proxy Server 5.2 is not impacted by this issue.


To determine if the Directory Server running on a system is affected, the following command can be used:

$ dpadm -V

If the output contains the version string 6.0, 6.1 or 6.2, the system is affected by this issue.

3. Symptoms

There are no predictable symptoms that would indicate this issue has been exploited.

4. Workaround

There is no workaround for this issue. Please see the Resolution section below.

5. Resolution

This issue is addressed in the following releases:

DSEE 6.3 Native Package Versions:
  • Solaris 9 and 10 SPARC patch 125276-07 or later
  • Solaris 9 x86 patch 125277-07 or later   
  • Solaris 10 x86 and x64 patch 125278-07 or later
  • Linux patch 125309-07 or later
DSEE 6.3 PatchZIP (Compressed Archive) versions:
  • Solaris 9 and 10 SPARC patch 126748-04 or later
  • Solaris 9 x86 patch 126749-04 or later
  • Solaris 10 x86 and x64 patch 126750-04 or later
  • Linux patch 126751-04 or later
  • Windows patch 126753-04 or later
  • HP-UX patch 126752-04 or later
Note: The above patches can be installed on any impacted release to upgrade it to version 6.3, thereby resolving this issue.

For more information on the upgrade process please see the following:

Directory Server 6.3 Release Notes are available at:


and the Directory Server 6.3 Installation Guide is available at:


For more information on Security Sun Alerts, see Technical Instruction ID 213557.

This Sun Alert notification is being provided to you on an "AS IS" basis. This Sun Alert notification may contain information provided by third parties. The issues described in this Sun Alert notification may or may not impact your system(s). Sun makes no representations, warranties, or guarantees as to the information contained herein. ANY AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE HEREBY DISCLAIMED. BY ACCESSING THIS DOCUMENT YOU ACKNOWLEDGE THAT SUN SHALL IN NO EVENT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE OUT OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN. This Sun Alert notification contains Sun proprietary and confidential information. It is being provided to you pursuant to the provisions of your agreement to purchase services from Sun, or, if you do not have such an agreement, the Sun.com Terms of Use. This Sun Alert notification may only be used for the purposes contemplated by these agreements.

Copyright 2000-2008 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved.


Attachments
This solution has no attachment

Wednesday Apr 16, 2008

DSEE 6.2 Sun Alert - Database integrity issues

http://sunsolve.sun.com/search/document.do?assetkey=1-66-235361-1

Please see the above link for the official Sun Alert document.  The below information is provided for quick reference only.  

For additional details please also see previous blog entry on this topic: http://blogs.sun.com/dsee/entry/directory_server_6_2_database 


Document Audience:PUBLIC
Document ID:235361
Title:Sun Java System Directory Server 6.2 Database integrity may be compromised
Copyright Notice:Copyright © 2008 Sun Microsystems, Inc. All Rights Reserved
Update Date:Mon Apr 14 00:00:00 MDT 2008

Solution Type Sun Alert
Solution  235361 :   Sun Java System Directory Server 6.2 Database integrity may be compromised

Bug ID: 6642430
Product: Sun Java System Directory Server 6.2, Enterprise Edition
Date of Resolved Release: 14-Apr-2008
SA Document Body: Sun Java System Directory Server 6.2 Database integrity may be compromised

1. Impact

A race condition may cause database pages for Sun Java System Directory Server to not sync to disk, resulting in possible Directory Server Database integrity issues. Depending on which pages are affected, the impact may vary.

2. Contributing Factors

This issue can occur in the following releases for all platforms (Solaris 8, 9, and 10 SPARC and x86 Platforms, Linux, Windows, HP-UX):
  • Sun Java System Directory Server Enterprise Edition 6.2
Note: Directory Server 6.1, 6.0, 5.2 and 5.1 are not affected by this issue.


To determine if the Directory Server running on a system is affected, the following command can be used:

    $ dsadm -V

If the output contains the version string 6.2, the system is affected.

3. Symptoms

Depending on which database page is affected and which operation tries to access it, the resulting error messages can be different, but in the most frequent cases a message similar to the following is logged:

    DEBUG - conn=-1 op=-1 msgId=-1 -  libdb: PANIC: fatal region error detected; run recovery

4. Workaround

There is no workaround for this issue. Please see the Resolution section below.

5. Resolution

This issue is addressed in the following releases: (please see blog entry http://blogs.sun.com/dsee/entry/dsee_6_3_released for more details)

DSEE 6.3 Native Package Versions:
  • Solaris 9 and 10 with SPARC patch 125276-07 or later
  • Solaris 9 x86 with patch 125277-07 or later
  • Solaris 10 x86 and x64 with patch 125278-07 or later
  • Linux with patch 125309-07 or later
  • Windows with patch 125311-07 or later
DSEE 6.3 PatchZIP (Compressed Archive) versions:
  • Solaris 9 and 10 with SPARC patch 126748-04 or later
  • Solaris 9 x86 with patch 126749-04 or later
  • Solaris 10 x86 and x64 with patch 126750-04 or later
  • Linux with patch 126751-04 or later
  • Windows with patch 126753-04 or later
  • HP-UX with patch 126752-04 or later
Note: After patches have been applied: Since the database integrity issue can be present but undetected, it is recommended to rebuild the database by exporting to an ldif file and reimporting the ldif file. In a replicated environment, all servers need to be rebuilt or reinitialized. Export/Import and initializing servers in a replicated environment is documented in the DSEE reference guide at:


This Sun Alert notification is being provided to you on an "AS IS" basis. This Sun Alert notification may contain information provided by third parties. The issues described in this Sun Alert notification may or may not impact your system(s). Sun makes no representations, warranties, or guarantees as to the information contained herein. ANY AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE HEREBY DISCLAIMED. BY ACCESSING THIS DOCUMENT YOU ACKNOWLEDGE THAT SUN SHALL IN NO EVENT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE OUT OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN. This Sun Alert notification contains Sun proprietary and confidential information. It is being provided to you pursuant to the provisions of your agreement to purchase services from Sun, or, if you do not have such an agreement, the Sun.com Terms of Use. This Sun Alert notification may only be used for the purposes contemplated by these agreements.

Copyright 2000-2008 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved.

 


Thursday Mar 27, 2008

Directory Server 6.2 - Possible Database Integrity Issues

We have become aware of a bug in Directory Server 6.2 only that could cause database integrity issues.   We have a hotfix for this issue, and if you are running Directory Server 6.2 and run into this problem then you should contact Sun Support and ask for the fix for the following bug

6642430: DB corruption (zero’d pages) when performing db2ldif against large 20GB ldif file.

The sunsolve record for this bug can be found at http://sunsolve.sun.com/search/document.do?assetkey=1-1-6642430-1.

NOTE: This issue does not affect Directory Server 6.0 or 6.1 release so you only need this fix if you are running Directory Server 6.2.

After you have the hotfix for this issue on Directory Server 6.2 and have applied the hotfix, then you will have to re-initialize the database from an LDIF backup to fully correct the corruption issue. Simply applying the hotfix will not fix the database if the database is already corrupted. Database corruption can be present though not detected with data in binary formats. You must therefore rebuild the database by importing an LDIF backup.

Directory Server Enterprise Edition 6.2 is no longer available for download and Directory Server Enterprise Edition 6.3, which includes a fix for this issue, will be available for download early April.  When upgrading to Directory Server 6.3 from 6.2 (not needed if you are on 6.0 or 6.1), make sure you export the database (db2ldif) prior to the upgrade and then re-import the database after the upgrade to fully re-initialize the database and to ensure that no corruption issues remain.
 

Recommended patch or upgrade procedures:

  1. Shut down each directory server instance, as described in Starting, Stopping, and Restarting a Directory Server Instance.

  2. Perform an LDIF export of the database, as described in Backing Up to LDIF.

  3. Install the hotfix for bug 6642430 on Directory Server 6.2, or upgrade your Directory Server 6.2 instance to Directory Server 6.3 once Directory Server 6.3 is available for download (early April). You will need to login to Sunsolve in order to see this bug description.

  4. Re-initialize the database from the LDIF exported in step 2, as described in Importing Data From an LDIF File.

    If you are running replicated instances of Directory Server, make sure you read Restoring Replicated Suffixes as well.

About

This blog provides information regarding the Directory Server Enterprise Edition products. Use this blog to get the latest breaking information regarding releases and updates plus other technical and non-technical information.

Search

Archives
« April 2014
SunMonTueWedThuFriSat
  
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
   
       
Today