Secunia

Peter Winter-Smith of NGSSoftware has reported a vulnerability in Red Hat Directory Server and Red Hat Certificate System, which can be exploited by malicious, local users to gain escalated privileges and potentially by malicious people to compromise a vulnerable system.

The vulnerability is caused due to a boundary error related to the Help buttons available in the Admin pages of the Management Console. This can be exploited to cause a stack-based buffer overflow by connecting to the Management Console and sending a specially crafted request.

According to the vendor, it is not possible to exploit the vulnerability remotely on Unix systems. However, it is exploitable by local users to gain root privileges.

The vulnerability has been reported in Red Hat Directory Server 7.1, Red Hat Certificate
System 7.1, and prior Netscape releases of these products.

Solution
The vendor has fixed the vulnerability in Red Hat Directory Server 7.1 SP1, which is available via Red Hat Network.
Further details available in Customer Area

Provided and/or discovered by
Peter Winter-Smith of NGSSoftware

Changelog
Further details available in Customer Area

Original Advisory
NGSSoftware:
http://www.ngssoftware.com/advisories/ntscpdsvr.txt

Deep Links
Links available in Customer Area