| Description: | The nss-pam-ldapd packages provide the nss-pam-ldapd daemon (nslcd), which uses a directory server to lookup name service information on behalf of a lightweight nsswitch module.
An array index error, leading to a stack-based buffer overflow flaw, was found in the way nss-pam-ldapd managed open file descriptors. An attacker able to make a process have a large number of open file descriptors and perform name lookups could use this flaw to cause the process to crash or, potentially, execute arbitrary code with the privileges of the user running the process. (CVE-2013-0288)
Red Hat would like to thank Garth Mollett for reporting this issue.
All users of nss-pam-ldapd are advised to upgrade to these updated packages, which contain a backported patch to fix this issue.
|