----------------------------------------------------------------------

We have updated our website, enjoy!
http://secunia.com/

----------------------------------------------------------------------

TITLE:
Red Hat Enterprise IPA Information Disclosure and Denial of Service

SECUNIA ADVISORY ID:
SA31791

VERIFY ADVISORY:
http://secunia.com/advisories/31791/

CRITICAL:
Less critical

IMPACT:
Exposure of sensitive information, DoS

WHERE:
>From local network

SOFTWARE:
Red Hat Enterprise IPA v.1 EL5
http://secunia.com/advisories/product/19792/

DESCRIPTION:
Some vulnerabilities have been reported in Red Hat Enterprise IPA,
which can be exploited by malicious people to disclose potentially
sensitive information and cause a DoS (Denial of Service).

1) Multiple memory leaks can be exploited to potentially exhaust all
available memory via specially crafted requests.

2) An error in the processing of LDAP search patterns can be
exploited to trigger a high CPU usage via specially crafted LDAP
requests.

3) An error exists within the installation procedure, resulting in
the master Kerberos password being retrievable via LDAP queries from
an anonymous connection, which can be exploited to disclose the
master Kerberos password.

SOLUTION:
Updated packages are available via Red Hat Network.
http://rhn.redhat.com

Note: Additional action is necessary to completely fix vulnerability
#3 (CVE-2008-3274). Please see vendor advisory for details.

PROVIDED AND/OR DISCOVERED BY:
1) The vendor credits Richard Megginson
2) The vendor credits Ulf Weltman of Hewlett Packard.
3) Reported by the vendor.

ORIGINAL ADVISORY:
https://rhn.redhat.com/errata/RHSA-2008-0858.html
https://rhn.redhat.com/errata/RHSA-2008-0860.html

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------