Note: This is an archival copy of Security Sun Alert 270789 as previously published on http://sunsolve.sun.com.|
Latest version of this security advisory is available from http://support.oracle.com as Sun Alert 1021100.1.
6828462, 6823593, 6782659, 6855978, 6648665
Sun Java System Directory Server Enterprise Edition 6.0
Sun Java System Directory Server Enterprise Edition 6.1
Sun Java System Directory Server Enterprise Edition 6.2
Sun Java System Directory Server Enterprise Edition 6.3
Date of Resolved Release
Directory Proxy Server Provided with Directory Server Enterprise Edition 6 is Subject to Denial of Service (DoS) and May Allow Unauthorized Access to Certain Data
Multiple security vulnerabilities in the Directory Proxy Server provided with Directory Server Enterprise Edition 6.x may allow a remote unprivileged user to do the following:
- cause a client operation to run temporarily with another client's privileges under certain circumstances
- cause the server to stop responding to new client connections, using specially forged packets
- prevent the server from sending results to other 'psearch' clients using a specially designed 'psearch' client"
2. Contributing Factors
These issues can occur in the following releases (for Solaris 9 and 10 on SPARC and x86 platforms, for Linux, and Windows):
PatchZIP (Compressed Archive) and Native package versions:
To determine if the Directory Proxy Server part of Directory Server Enterprise Edition running on a system is affected, the following command can be used:
$ dpadm -VIf the output contains the version string 6.0, 6.1, 6.2, 6.3 or 6.3.1, the system is affected by this issue.
If the server is affected by these vulnerabilities, the following symptoms can be seen:
- A client operation running temporarily with another client's privileges may fail if temporary privileges are not suitable.
- The server doesn't answer to new client connections until restarted and messages are logged in the error log.
- The server consumes 100% of a given Core/CPU and psearch clients do not receive updates.
There is no workaround for these issues. Please see the Resolution section below.
These issues are addressed in the following release (for Solaris 9 and 10 on SPARC and x86 platforms, for Linux, and Windows):
The upgrade procedure is described in "Sun Java System Directory Server Enterprise Edition 6.3.1 Release Notes" in Chapter 2 at:
For more information on Security Sun Alerts, see 1009886.1.
Copyright 2000-2009 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved.
This solution has no attachment