oss-security - Re: openldap DoS

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / NEWS community lists Wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Tue, 01 Jul 2008 11:05:37 -0400
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: openldap DoS

On 30 June 2008, Josh Bressers wrote:
> On 30 June 2008, Ludwig Nussel wrote:
> > Hi,
> > 
> > Remote unauthenticated attackers can trigger an assertion in the ASN.1 BER
> > decoding of openlap and crash the server:
> > http://www.openldap.org/its/index.cgi/Software%20Bugs?id=5580;selectid=5580
> > 
> 
> The patch is here it seems:
> http://www.openldap.org/devel/cvsweb.cgi/libraries/liblber/io.c.diff?r1=1.120&r2=1.121&hideattic=1&sortbydate=0
> 

So It seems from my testing, this flaw does not trigger the assertion on
OpenLDAP version 2.0.27, but does on at least 2.2.13.

As upstream suggested this was added in version 1.88 of the io.c file, that
would suggest this flaw should affect OpenLDAP versions after 2.1.20 (don't
quote me on this, as I'm not completely sure, it could affect a few older
versions around 2.1.20).

Thanks.

-- 
    JB

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.