{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated nss_ldap packages are now available for Red Hat Linux 6.2, 7,\n7.1, 7.2, and 7.3. These packages fix a string format vulnerability in the\npam_ldap module.\n\n[Update Jun 4, 2002]\nReplacement packages have been added for Red Hat Linux 6.2. The previous\npackages could not be installed with the version of RPM that shipped with\nRed Hat Linux 6.2.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The pam_ldap module provides authentication for user access to a system by\nconsulting a directory using LDAP. Versions of pam_ldap prior to version\n144 include a format string bug in the logging function. The packages\nincluded in this erratum update pam_ldap to version 144, fixing this bug.\n\nThe Common Vulnerabilities and Exposures project (cve.mitre.org) has\nassigned the name CAN-2002-0374 to this issue.\n\nDue to differences in the default behavior of the pam_ldap module when\nperforming account management, the version of authconfig included in Red\nRat Linux 7.2 generates incorrect /etc/pam.d/system-auth files for \nthe version of pam_ldap included in this erratum.  Thus, an updated \nversion of authconfig for Red Hat Linux 7.2 is included in this erratum \n(versions of authconfig included with Red Hat Linux 7, 7.1, and 7.3 are not\naffected).\n\nOur thanks go to the pam_ldap team at padl.com for bringing this to our\nattention.\n\nA previous revision of this erratum included packages which could not be\ninstalled with the version of RPM included with Red Hat Linux 6.2.  While\nthey can be installed with versions of RPM which have been released as\nerrata for Red Hat Linux 6.2, this revision includes packages which remove\nthis restriction.  Packages for Red Hat Linux 7, 7.1, 7.2, and 7.3 have not\nbeen modified.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2002:084",
        "url": "https://access.redhat.com/errata/RHSA-2002:084"
      },
      {
        "category": "external",
        "summary": "http://www.padl.com/OSS/pam_ldap.html",
        "url": "http://www.padl.com/OSS/pam_ldap.html"
      },
      {
        "category": "external",
        "summary": "http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0053.html",
        "url": "http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0053.html"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2002/rhsa-2002_084.json"
      }
    ],
    "title": "Red Hat Security Advisory: : : : Updated nss_ldap packages fix pam_ldap vulnerability",
    "tracking": {
      "current_release_date": "2024-11-21T22:21:42+00:00",
      "generator": {
        "date": "2024-11-21T22:21:42+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2002:084",
      "initial_release_date": "2002-05-27T07:55:00+00:00",
      "revision_history": [
        {
          "date": "2002-05-27T07:55:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2002-05-07T00:00:00+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-21T22:21:42+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Linux 6.2",
                "product": {
                  "name": "Red Hat Linux 6.2",
                  "product_id": "Red Hat Linux 6.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:linux:6.2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Linux 7.0",
                "product": {
                  "name": "Red Hat Linux 7.0",
                  "product_id": "Red Hat Linux 7.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:linux:7.0"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Linux 7.1",
                "product": {
                  "name": "Red Hat Linux 7.1",
                  "product_id": "Red Hat Linux 7.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:linux:7.1"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Linux 7.2",
                "product": {
                  "name": "Red Hat Linux 7.2",
                  "product_id": "Red Hat Linux 7.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:linux:7.2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Linux 7.3",
                "product": {
                  "name": "Red Hat Linux 7.3",
                  "product_id": "Red Hat Linux 7.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:linux:7.3"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Linux"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2002-0374",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1616764"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Format string vulnerability in the logging function for the pam_ldap PAM LDAP module before version 144 allows attackers to execute arbitrary code via format strings in the configuration file name.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Linux 6.2",
          "Red Hat Linux 7.0",
          "Red Hat Linux 7.1",
          "Red Hat Linux 7.2",
          "Red Hat Linux 7.3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2002-0374"
        },
        {
          "category": "external",
          "summary": "RHBZ#1616764",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616764"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2002-0374",
          "url": "https://www.cve.org/CVERecord?id=CVE-2002-0374"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-0374",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-0374"
        }
      ],
      "release_date": "2002-05-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2002-05-27T07:55:00+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade.  Only those\nRPMs which are currently installed will be updated.  Those RPMs which are\nnot installed but included in the list will not be updated.  Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains\nthe desired RPMs.\n\nPlease note that this update is also available via Red Hat Network.  Many\npeople find this an easier way to apply updates.  To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
          "product_ids": [
            "Red Hat Linux 6.2",
            "Red Hat Linux 7.0",
            "Red Hat Linux 7.1",
            "Red Hat Linux 7.2",
            "Red Hat Linux 7.3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2002:084"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "security flaw"
    }
  ]
}