Description
Race condition in nss_ldap, when used in applications that are linked against the pthread library and fork after a call to nss_ldap, might send user data to the wrong process because of improper handling of the LDAP connection. NOTE: this issue was originally reported for Dovecot with the wrong mailboxes being returned, but other applications might also be affected.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 11 | libnss-ldap | 256-1 | — |
| Debian 4.0 | libnss-ldap | 251-7.5etch1 | DSA-1430-1 |
| Debian 3.1 | libnss-ldap | 238-1sarge1 | DSA-1430-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | nss_ldap | 253-12.el5 | RHSA-2008:0389 |
| RHEL 4 | nss_ldap | 253-5.el4 | RHSA-2008:0715 |
Advisories 3
- RHSA-2008:0715 Red Hat Security Advisory: nss_ldap security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0389 Red Hat Security Advisory: nss_ldap security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1430-1 libnss-ldap - information disclosure Debian Security (DSA / DLA) · Mar 9, 2026
References
- 28061 third-party-advisory
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=453868
- 27670 third-party-advisory
- [Dovecot] 20050303 hanging imap... and users getting other users' emails! mailing-list
- https://bugzilla.redhat.com/show_bug.cgi?id=154314
- http://bugs.gentoo.org/show_bug.cgi?id=198390
- 29083 third-party-advisory
- GLSA-200711-33 vendor-advisory
- [Dovecot] 20050409 Authentication and the wrong mailbox? mailing-list
- 20080212 FLEA-2008-0003-1 nss_ldap mailing-list
- oval:org.mitre.oval:def:10625 vdb-entry signature
- https://issues.rpath.com/browse/RPL-1913
- 27768 third-party-advisory
- 26452 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=367461
- 27839 third-party-advisory
- RHSA-2008:0389 vendor-advisory
- MDVSA-2008:049 vendor-advisory
- 30352 third-party-advisory
- 31227 third-party-advisory
- DSA-1430 vendor-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2008-332.htm
- 31524 third-party-advisory
- 1020088 vdb-entry
- RHSA-2008:0715 vendor-advisory
- 28838 third-party-advisory
- SUSE-SR:2008:003 vendor-advisory
- nssldap-ldap-race-condition(38505) vdb-entry
- http://wiki.rpath.com/wiki/Advisories:rPSA-2007-0255