—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2015:225
http://www.mandriva.com/en/support/security/
_______________________________________________________________________

Package : cherokee
Date : May 4, 2015
Affected: Business Server 1.0
_______________________________________________________________________

Problem Description:

Updated cherokee packages fix security vulnerability:

The cherokee_validator_ldap_check function in validator_ldap.c in
Cherokee 1.2.103 and earlier, when LDAP is used, does not properly
consider unauthenticated-bind semantics, which allows remote attackers
to bypass authentication via an empty password (CVE-2014-4668).
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4668
http://advisories.mageia.org/MGASA-2015-0181.html
_______________________________________________________________________

Updated Packages:

Mandriva Business Server 1/X86_64:
da0714c2694349901f329b7be76cb17f mbs1/x86_64/cget-1.2.101-8.1.mbs1.x86_64.rpm
387a32522ce8dd469d8f6689f1ad8b17 mbs1/x86_64/cherokee-1.2.101-8.1.mbs1.x86_64.rpm
4e4d4cf5c6fa797bcd95223f3ad396a8 mbs1/x86_64/cherokee-devel-1.2.101-8.1.mbs1.x86_64.rpm
5c1c910636c338173bc7df734811ad72 mbs1/x86_64/lib64cherokee-base0-1.2.101-8.1.mbs1.x86_64.rpm
0e94af76b87329e56783b01e26cf7cfb mbs1/x86_64/lib64cherokee-client0-1.2.101-8.1.mbs1.x86_64.rpm
f6e55ca4dd2f0c7350380d0af98d4c82 mbs1/x86_64/lib64cherokee-server0-1.2.101-8.1.mbs1.x86_64.rpm
2bd3ca3626fe3cc446d006160bcfeb84 mbs1/SRPMS/cherokee-1.2.101-8.1.mbs1.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg –recv-keys –keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFVR5lkmqjQ0CJFipgRAkz/AJ92e0TE8pG5hAa4+jcOUOeOMjxGxwCfQvqP
XKs0Xx65F8w1nnYDBZ57Gps=
=Zi00
—–END PGP SIGNATURE—–

To unsubscribe, send a email to sympa@mandrivalinux.org
with this subject : unsubscribe security-announce
_______________________________________________________
Want to buy your Pack or Services from Mandriva?
Go to http://store.mandriva.com
_______________________________________________________