{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An updated redhat-ds package containing a number of fixes is now available\nas Red Hat Directory Server 7.1 Service Pack 2.\n\nThis update has been rated as having a moderate security impact by the Red\nHat Security Response Team.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Directory Server is an LDAPv3 compliant server.\n\nFor the latest information, refer to the release notes at the\nfollowing URL:\n\n    http://www.redhat.com/docs/manuals/dir-server\n\nEvgeny Legerov discovered several flaws affecting Red Hat Directory Server\nusing the GLEG ProtoVer LDAP test suite.  A remote attacker who is able to\nconnect to the directory server could send malicious requests which would\ncause the server to crash, leading to a denial of service. (CVE-2006-0451,\nCVE-2006-0452, CVE-2006-0453)\n\nThis update also addresses the following issues:\n\n* 173687 - When the Directory Server\u0027s effective user and the real user \n  are different, there was a small window that creates log files owned by\n  the real user, which should be owned by the effective user.\n\n* 175063 - When an ldif file contains an entry with the dn that includes\n  escaped double quotes, importing the entry could fail and the\n  entry is skipped. The following reindex fails due to the skip.\n\n* 175897 - There was a problem in evaluating the intersection of multiple\n  range searches when the attribute of each range search is different from\n  each other. \n\n  For example: \n\n    \u0026(attr1 \u003c= val1)(attr2 \u003e= val2)  \n\n  This issue has been fixed.\n\n* 185477 - In previous 7.X versions of Red Hat Directory Server, importing\n  a malformed parent entry and some child entries resulted in the child\n  entries being successfully added without a parent.\n\n* 184585 - The server did not allow a re-bind using SASL on the same\n  connection, returning error 49.\n\n* 185765 - The password sync tool leaked memory.\n\n* 181827 - Deleting an attribute value by trimming it\u0027s value to an empty\n  string in Active Directory did not sync to Red Hat Directory Server. This\n  issue has been fixed. \n\n* 186657 - Sustained heavy password modification load on the Active\n  Directory side could potentially crash passsync.exe. This issue has been\n  fixed.\n\nUsers are advised to upgrade to this updated package, which resolves these\nissues.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2006:0270",
        "url": "https://access.redhat.com/errata/RHSA-2006:0270"
      },
      {
        "category": "external",
        "summary": "http://www.redhat.com/security/updates/classification/#moderate",
        "url": "http://www.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "173687",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=173687"
      },
      {
        "category": "external",
        "summary": "175063",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=175063"
      },
      {
        "category": "external",
        "summary": "175897",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=175897"
      },
      {
        "category": "external",
        "summary": "179135",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=179135"
      },
      {
        "category": "external",
        "summary": "179137",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=179137"
      },
      {
        "category": "external",
        "summary": "181827",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=181827"
      },
      {
        "category": "external",
        "summary": "184585",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=184585"
      },
      {
        "category": "external",
        "summary": "185477",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=185477"
      },
      {
        "category": "external",
        "summary": "185765",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=185765"
      },
      {
        "category": "external",
        "summary": "186657",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=186657"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2006/rhsa-2006_0270.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Directory Server 7.1 security update",
    "tracking": {
      "current_release_date": "2025-08-04T11:43:31+00:00",
      "generator": {
        "date": "2025-08-04T11:43:31+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.6"
        }
      },
      "id": "RHSA-2006:0270",
      "initial_release_date": "2006-05-17T17:05:00+00:00",
      "revision_history": [
        {
          "date": "2006-05-17T17:05:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2006-05-17T00:00:00+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-08-04T11:43:31+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "RHEL 4 Directory Server AS",
                "product": {
                  "name": "RHEL 4 Directory Server AS",
                  "product_id": "RHEL 4 Directory Server AS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:directory_server:7.1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Directory Server"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2006-0451",
      "discovery_date": "2007-02-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "179135"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Multiple memory leaks in the LDAP component in Fedora Directory Server 1.0 allow remote attackers to cause a denial of service (memory consumption) via invalid BER packets that trigger an error, which might prevent memory from being freed if it was allocated during the ber_scanf call, as demonstrated using the ProtoVer LDAP test suite.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "memory leaks using ber_scanf when handling bad BER packets (CVE-2006-0453)",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "RHEL 4 Directory Server AS"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2006-0451"
        },
        {
          "category": "external",
          "summary": "RHBZ#179135",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=179135"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2006-0451",
          "url": "https://www.cve.org/CVERecord?id=CVE-2006-0451"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2006-0451",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2006-0451"
        }
      ],
      "release_date": "2007-02-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2006-05-17T17:05:00+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade.  Only those\nRPMs which are currently installed will be updated.  Those RPMs which are\nnot installed but included in the list will not be updated.  Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network.  Many\npeople find this an easier way to apply updates.  To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
          "product_ids": [
            "RHEL 4 Directory Server AS"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2006:0270"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "memory leaks using ber_scanf when handling bad BER packets (CVE-2006-0453)"
    },
    {
      "cve": "CVE-2006-0452",
      "discovery_date": "2004-06-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "179137"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "dn2ancestor in the LDAP component in Fedora Directory Server 1.0 allows remote attackers to cause a denial of service (CPU and memory consumption) via a ModDN operation with a DN that contains a large number of \",\" (comma) characters, which results in a large amount of recursion, as demonstrated using the ProtoVer LDAP test suite.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "recursion causes OOM with bad DN in dn2ancestor",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "RHEL 4 Directory Server AS"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2006-0452"
        },
        {
          "category": "external",
          "summary": "RHBZ#179137",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=179137"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2006-0452",
          "url": "https://www.cve.org/CVERecord?id=CVE-2006-0452"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2006-0452",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2006-0452"
        }
      ],
      "release_date": "2004-12-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2006-05-17T17:05:00+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade.  Only those\nRPMs which are currently installed will be updated.  Those RPMs which are\nnot installed but included in the list will not be updated.  Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network.  Many\npeople find this an easier way to apply updates.  To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
          "product_ids": [
            "RHEL 4 Directory Server AS"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2006:0270"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "recursion causes OOM with bad DN in dn2ancestor"
    },
    {
      "cve": "CVE-2006-0453",
      "discovery_date": "2006-01-24T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1617999"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The LDAP component in Fedora Directory Server 1.0 allow remote attackers to cause a denial of service (crash) via a certain \"bad BER sequence\" that results in a free of uninitialized memory, as demonstrated using the ProtoVer LDAP test suite.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "RHEL 4 Directory Server AS"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2006-0453"
        },
        {
          "category": "external",
          "summary": "RHBZ#1617999",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617999"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2006-0453",
          "url": "https://www.cve.org/CVERecord?id=CVE-2006-0453"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2006-0453",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2006-0453"
        }
      ],
      "release_date": "2005-02-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2006-05-17T17:05:00+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade.  Only those\nRPMs which are currently installed will be updated.  Those RPMs which are\nnot installed but included in the list will not be updated.  Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network.  Many\npeople find this an easier way to apply updates.  To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
          "product_ids": [
            "RHEL 4 Directory Server AS"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2006:0270"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "security flaw"
    }
  ]
}