Synopsis:          Moderate: ipa and slapi-nis security and bug fix update
Advisory ID:       SLSA-2015:0728-1
Issue Date:        2015-03-26
CVE Numbers:       CVE-2015-0283
                   CVE-2015-1827
--

The ipa component provides centrally managed Identity, Policy, and Audit.
The slapi-nis component provides NIS Server and Schema Compatibility plug-
ins for Directory Server.

It was discovered that the IPA extdom Directory Server plug-in did not
correctly perform memory reallocation when handling user account
information. A request for a list of groups for a user that belongs to a
large number of groups would cause a Directory Server to crash.
(CVE-2015-1827)

It was discovered that the slapi-nis Directory Server plug-in did not
correctly perform memory reallocation when handling user account
information. A request for information about a group with many members, or
a request for a user that belongs to a large number of groups, would cause
a Directory Server to enter an infinite loop and consume an excessive
amount of CPU time. (CVE-2015-0283)

This update fixes the following bugs:

* Previously, users of IdM were not properly granted the default
permission to read the "facsimiletelephonenumber" user attribute. This
update adds "facsimiletelephonenumber" to the Access Control Instruction
(ACI) for user data, which makes the attribute readable to authenticated
users as expected.

* Prior to this update, when a DNS zone was saved in an LDAP database
without a dot character (.) at the end, internal DNS commands and
operations, such as dnsrecord-* or dnszone-*, failed. With this update,
DNS commands always supply the DNS zone with a dot character at the end,
which prevents the described problem.

* After a full-server IdM restore operation, the restored server in some
cases contained invalid data. In addition, if the restored server was used
to reinitialize a replica, the replica then contained invalid data as
well. To fix this problem, the IdM API is now created correctly during the
restore operation, and *.ldif files are not skipped during the removal of
RUV data. As a result, the restored server and its replica no longer
contain invalid data.

* Previously, a deadlock in some cases occurred during an IdM upgrade,
which could cause the IdM server to become unresponsive. With this update,
the Schema Compatibility plug-in has been adjusted not to parse the
subtree that contains the configuration of the DNA plug-in, which prevents
this deadlock from triggering.

* When using the extdom plug-in of IdM to handle large groups, user
lookups and group lookups previously failed due to insufficient buffer
size. With this update, the getgrgid_r() call gradually increases the
buffer length if needed, and the described failure of extdom thus no
longer occurs.
--

SL7
  x86_64
    ipa-client-4.1.0-18.sl7_1.3.x86_64.rpm
    ipa-debuginfo-4.1.0-18.sl7_1.3.x86_64.rpm
    ipa-python-4.1.0-18.sl7_1.3.x86_64.rpm
    ipa-admintools-4.1.0-18.sl7_1.3.x86_64.rpm
    ipa-server-4.1.0-18.sl7_1.3.x86_64.rpm
    ipa-server-trust-ad-4.1.0-18.sl7_1.3.x86_64.rpm
    slapi-nis-0.54-3.el7_1.x86_64.rpm
    slapi-nis-debuginfo-0.54-3.el7_1.x86_64.rpm

- Scientific Linux Development Team