Security update for openldap2 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2016:0224-1 Final 1 1 2016-01-25T08:47:53Z current 2016-01-25T08:47:53Z 2016-01-25T08:47:53Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for openldap2 This update fixes the following security issues: - CVE-2015-6908: The ber_get_next function allowed remote attackers to cause a denial of service (reachable assertion and application crash) via crafted BER data, as demonstrated by an attack against slapd. (bsc#945582) - CVE-2015-4000: Fix weak Diffie-Hellman size vulnerability. (bsc#937766) It also fixes the following non-security bugs: - bsc#955210: Unresponsive LDAP host lookups in IPv6 environment This update adds the following functionality: - fate#319300: SHA2 password hashing module that can be loaded on-demand. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-DESKTOP-12-2016-139,SUSE-SLE-DESKTOP-12-SP1-2016-139,SUSE-SLE-Module-Legacy-12-2016-139,SUSE-SLE-SAP-12-2016-139,SUSE-SLE-SDK-12-2016-139,SUSE-SLE-SDK-12-SP1-2016-139,SUSE-SLE-SERVER-12-2016-139,SUSE-SLE-SERVER-12-SP1-2016-139 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2016/suse-su-20160224-1/ Link for SUSE-SU-2016:0224-1 https://lists.opensuse.org/opensuse-security-announce/2016-01/msg00031.html E-Mail link for SUSE-SU-2016:0224-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/937766 SUSE Bug 937766 https://bugzilla.suse.com/945582 SUSE Bug 945582 https://bugzilla.suse.com/955210 SUSE Bug 955210 https://www.suse.com/security/cve/CVE-2015-4000/ SUSE CVE CVE-2015-4000 page https://www.suse.com/security/cve/CVE-2015-6908/ SUSE CVE CVE-2015-6908 page SUSE Linux Enterprise Desktop 12 SUSE Linux Enterprise Desktop 12 SP1 SUSE Linux Enterprise Module for Legacy 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server 12 SP1 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Server for SAP Applications 12 SP1 SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Software Development Kit 12 SP1 libldap-2_4-2-2.4.41-18.13.1 libldap-2_4-2-32bit-2.4.41-18.13.1 openldap2-client-2.4.41-18.13.1 compat-libldap-2_3-0-2.3.37-18.13.4 openldap2-back-perl-2.4.41-18.13.4 openldap2-devel-2.4.41-18.13.1 openldap2-devel-static-2.4.41-18.13.1 openldap2-2.4.41-18.13.4 openldap2-back-meta-2.4.41-18.13.4 libldap-2_4-2-2.4.41-18.13.1 as a component of SUSE Linux Enterprise Desktop 12 libldap-2_4-2-32bit-2.4.41-18.13.1 as a component of SUSE Linux Enterprise Desktop 12 openldap2-client-2.4.41-18.13.1 as a component of SUSE Linux Enterprise Desktop 12 libldap-2_4-2-2.4.41-18.13.1 as a component of SUSE Linux Enterprise Desktop 12 SP1 libldap-2_4-2-32bit-2.4.41-18.13.1 as a component of SUSE Linux Enterprise Desktop 12 SP1 openldap2-client-2.4.41-18.13.1 as a component of SUSE Linux Enterprise Desktop 12 SP1 compat-libldap-2_3-0-2.3.37-18.13.4 as a component of SUSE Linux Enterprise Module for Legacy 12 libldap-2_4-2-2.4.41-18.13.1 as a component of SUSE Linux Enterprise Server 12 libldap-2_4-2-32bit-2.4.41-18.13.1 as a component of SUSE Linux Enterprise Server 12 openldap2-2.4.41-18.13.4 as a component of SUSE Linux Enterprise Server 12 openldap2-back-meta-2.4.41-18.13.4 as a component of SUSE Linux Enterprise Server 12 openldap2-client-2.4.41-18.13.1 as a component of SUSE Linux Enterprise Server 12 libldap-2_4-2-2.4.41-18.13.1 as a component of SUSE Linux Enterprise Server 12 SP1 libldap-2_4-2-32bit-2.4.41-18.13.1 as a component of SUSE Linux Enterprise Server 12 SP1 openldap2-2.4.41-18.13.4 as a component of SUSE Linux Enterprise Server 12 SP1 openldap2-back-meta-2.4.41-18.13.4 as a component of SUSE Linux Enterprise Server 12 SP1 openldap2-client-2.4.41-18.13.1 as a component of SUSE Linux Enterprise Server 12 SP1 compat-libldap-2_3-0-2.3.37-18.13.4 as a component of SUSE Linux Enterprise Server for SAP Applications 12 libldap-2_4-2-2.4.41-18.13.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 libldap-2_4-2-32bit-2.4.41-18.13.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 openldap2-2.4.41-18.13.4 as a component of SUSE Linux Enterprise Server for SAP Applications 12 openldap2-back-meta-2.4.41-18.13.4 as a component of SUSE Linux Enterprise Server for SAP Applications 12 openldap2-client-2.4.41-18.13.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 libldap-2_4-2-2.4.41-18.13.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 libldap-2_4-2-32bit-2.4.41-18.13.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 openldap2-2.4.41-18.13.4 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 openldap2-back-meta-2.4.41-18.13.4 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 openldap2-client-2.4.41-18.13.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 openldap2-back-perl-2.4.41-18.13.4 as a component of SUSE Linux Enterprise Software Development Kit 12 openldap2-devel-2.4.41-18.13.1 as a component of SUSE Linux Enterprise Software Development Kit 12 openldap2-devel-static-2.4.41-18.13.1 as a component of SUSE Linux Enterprise Software Development Kit 12 openldap2-back-perl-2.4.41-18.13.4 as a component of SUSE Linux Enterprise Software Development Kit 12 SP1 openldap2-devel-2.4.41-18.13.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP1 openldap2-devel-static-2.4.41-18.13.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP1 The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the "Logjam" issue. CVE-2015-4000 SUSE Linux Enterprise Desktop 12 SP1:libldap-2_4-2-2.4.41-18.13.1 SUSE Linux Enterprise Desktop 12 SP1:libldap-2_4-2-32bit-2.4.41-18.13.1 SUSE Linux Enterprise Desktop 12 SP1:openldap2-client-2.4.41-18.13.1 SUSE Linux Enterprise Desktop 12:libldap-2_4-2-2.4.41-18.13.1 SUSE Linux Enterprise Desktop 12:libldap-2_4-2-32bit-2.4.41-18.13.1 SUSE Linux Enterprise Desktop 12:openldap2-client-2.4.41-18.13.1 SUSE Linux Enterprise Module for Legacy 12:compat-libldap-2_3-0-2.3.37-18.13.4 SUSE Linux Enterprise Server 12 SP1:libldap-2_4-2-2.4.41-18.13.1 SUSE Linux Enterprise Server 12 SP1:libldap-2_4-2-32bit-2.4.41-18.13.1 SUSE Linux Enterprise Server 12 SP1:openldap2-2.4.41-18.13.4 SUSE Linux Enterprise Server 12 SP1:openldap2-back-meta-2.4.41-18.13.4 SUSE Linux Enterprise Server 12 SP1:openldap2-client-2.4.41-18.13.1 SUSE Linux Enterprise Server 12:libldap-2_4-2-2.4.41-18.13.1 SUSE Linux Enterprise Server 12:libldap-2_4-2-32bit-2.4.41-18.13.1 SUSE Linux Enterprise Server 12:openldap2-2.4.41-18.13.4 SUSE Linux Enterprise Server 12:openldap2-back-meta-2.4.41-18.13.4 SUSE Linux Enterprise Server 12:openldap2-client-2.4.41-18.13.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:libldap-2_4-2-2.4.41-18.13.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:libldap-2_4-2-32bit-2.4.41-18.13.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:openldap2-2.4.41-18.13.4 SUSE Linux Enterprise Server for SAP Applications 12 SP1:openldap2-back-meta-2.4.41-18.13.4 SUSE Linux Enterprise Server for SAP Applications 12 SP1:openldap2-client-2.4.41-18.13.1 SUSE Linux Enterprise Server for SAP Applications 12:compat-libldap-2_3-0-2.3.37-18.13.4 SUSE Linux Enterprise Server for SAP Applications 12:libldap-2_4-2-2.4.41-18.13.1 SUSE Linux Enterprise Server for SAP Applications 12:libldap-2_4-2-32bit-2.4.41-18.13.1 SUSE Linux Enterprise Server for SAP Applications 12:openldap2-2.4.41-18.13.4 SUSE Linux Enterprise Server for SAP Applications 12:openldap2-back-meta-2.4.41-18.13.4 SUSE Linux Enterprise Server for SAP Applications 12:openldap2-client-2.4.41-18.13.1 SUSE Linux Enterprise Software Development Kit 12 SP1:openldap2-back-perl-2.4.41-18.13.4 SUSE Linux Enterprise Software Development Kit 12 SP1:openldap2-devel-2.4.41-18.13.1 SUSE Linux Enterprise Software Development Kit 12 SP1:openldap2-devel-static-2.4.41-18.13.1 SUSE Linux Enterprise Software Development Kit 12:openldap2-back-perl-2.4.41-18.13.4 SUSE Linux Enterprise Software Development Kit 12:openldap2-devel-2.4.41-18.13.1 SUSE Linux Enterprise Software Development Kit 12:openldap2-devel-static-2.4.41-18.13.1 important 7.3 AV:N/AC:H/Au:N/C:C/I:C/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20160224-1/ https://www.suse.com/security/cve/CVE-2015-4000.html CVE-2015-4000 https://bugzilla.suse.com/1074631 SUSE Bug 1074631 https://bugzilla.suse.com/1211968 SUSE Bug 1211968 https://bugzilla.suse.com/931600 SUSE Bug 931600 https://bugzilla.suse.com/931698 SUSE Bug 931698 https://bugzilla.suse.com/931723 SUSE Bug 931723 https://bugzilla.suse.com/931845 SUSE Bug 931845 https://bugzilla.suse.com/932026 SUSE Bug 932026 https://bugzilla.suse.com/932483 SUSE Bug 932483 https://bugzilla.suse.com/934789 SUSE Bug 934789 https://bugzilla.suse.com/935033 SUSE Bug 935033 https://bugzilla.suse.com/935540 SUSE Bug 935540 https://bugzilla.suse.com/935979 SUSE Bug 935979 https://bugzilla.suse.com/937202 SUSE Bug 937202 https://bugzilla.suse.com/937766 SUSE Bug 937766 https://bugzilla.suse.com/938248 SUSE Bug 938248 https://bugzilla.suse.com/938432 SUSE Bug 938432 https://bugzilla.suse.com/938895 SUSE Bug 938895 https://bugzilla.suse.com/938905 SUSE Bug 938905 https://bugzilla.suse.com/938906 SUSE Bug 938906 https://bugzilla.suse.com/938913 SUSE Bug 938913 https://bugzilla.suse.com/938945 SUSE Bug 938945 https://bugzilla.suse.com/943664 SUSE Bug 943664 https://bugzilla.suse.com/944729 SUSE Bug 944729 https://bugzilla.suse.com/945582 SUSE Bug 945582 https://bugzilla.suse.com/955589 SUSE Bug 955589 https://bugzilla.suse.com/980406 SUSE Bug 980406 https://bugzilla.suse.com/990592 SUSE Bug 990592 https://bugzilla.suse.com/994144 SUSE Bug 994144 The ber_get_next function in libraries/liblber/io.c in OpenLDAP 2.4.42 and earlier allows remote attackers to cause a denial of service (reachable assertion and application crash) via crafted BER data, as demonstrated by an attack against slapd. CVE-2015-6908 SUSE Linux Enterprise Desktop 12 SP1:libldap-2_4-2-2.4.41-18.13.1 SUSE Linux Enterprise Desktop 12 SP1:libldap-2_4-2-32bit-2.4.41-18.13.1 SUSE Linux Enterprise Desktop 12 SP1:openldap2-client-2.4.41-18.13.1 SUSE Linux Enterprise Desktop 12:libldap-2_4-2-2.4.41-18.13.1 SUSE Linux Enterprise Desktop 12:libldap-2_4-2-32bit-2.4.41-18.13.1 SUSE Linux Enterprise Desktop 12:openldap2-client-2.4.41-18.13.1 SUSE Linux Enterprise Module for Legacy 12:compat-libldap-2_3-0-2.3.37-18.13.4 SUSE Linux Enterprise Server 12 SP1:libldap-2_4-2-2.4.41-18.13.1 SUSE Linux Enterprise Server 12 SP1:libldap-2_4-2-32bit-2.4.41-18.13.1 SUSE Linux Enterprise Server 12 SP1:openldap2-2.4.41-18.13.4 SUSE Linux Enterprise Server 12 SP1:openldap2-back-meta-2.4.41-18.13.4 SUSE Linux Enterprise Server 12 SP1:openldap2-client-2.4.41-18.13.1 SUSE Linux Enterprise Server 12:libldap-2_4-2-2.4.41-18.13.1 SUSE Linux Enterprise Server 12:libldap-2_4-2-32bit-2.4.41-18.13.1 SUSE Linux Enterprise Server 12:openldap2-2.4.41-18.13.4 SUSE Linux Enterprise Server 12:openldap2-back-meta-2.4.41-18.13.4 SUSE Linux Enterprise Server 12:openldap2-client-2.4.41-18.13.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:libldap-2_4-2-2.4.41-18.13.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:libldap-2_4-2-32bit-2.4.41-18.13.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:openldap2-2.4.41-18.13.4 SUSE Linux Enterprise Server for SAP Applications 12 SP1:openldap2-back-meta-2.4.41-18.13.4 SUSE Linux Enterprise Server for SAP Applications 12 SP1:openldap2-client-2.4.41-18.13.1 SUSE Linux Enterprise Server for SAP Applications 12:compat-libldap-2_3-0-2.3.37-18.13.4 SUSE Linux Enterprise Server for SAP Applications 12:libldap-2_4-2-2.4.41-18.13.1 SUSE Linux Enterprise Server for SAP Applications 12:libldap-2_4-2-32bit-2.4.41-18.13.1 SUSE Linux Enterprise Server for SAP Applications 12:openldap2-2.4.41-18.13.4 SUSE Linux Enterprise Server for SAP Applications 12:openldap2-back-meta-2.4.41-18.13.4 SUSE Linux Enterprise Server for SAP Applications 12:openldap2-client-2.4.41-18.13.1 SUSE Linux Enterprise Software Development Kit 12 SP1:openldap2-back-perl-2.4.41-18.13.4 SUSE Linux Enterprise Software Development Kit 12 SP1:openldap2-devel-2.4.41-18.13.1 SUSE Linux Enterprise Software Development Kit 12 SP1:openldap2-devel-static-2.4.41-18.13.1 SUSE Linux Enterprise Software Development Kit 12:openldap2-back-perl-2.4.41-18.13.4 SUSE Linux Enterprise Software Development Kit 12:openldap2-devel-2.4.41-18.13.1 SUSE Linux Enterprise Software Development Kit 12:openldap2-devel-static-2.4.41-18.13.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20160224-1/ https://www.suse.com/security/cve/CVE-2015-6908.html CVE-2015-6908 https://bugzilla.suse.com/945582 SUSE Bug 945582