oss-security - CVE Request: openldap2 UTF8StringNormalize() can cause a (one-byte) buffer overflow

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20111026142645.GA13364@suse.de>
Date: Wed, 26 Oct 2011 16:26:45 +0200
From: Marcus Meissner <meissner@...e.de>
To: OSS Security List <oss-security@...ts.openwall.com>
Subject: CVE Request: openldap2 UTF8StringNormalize() can cause a (one-byte) buffer overflow

Hi,

From our openldap2 Maintainer Ralf:
|A bug in UTF8StringNormalize() can cause a (one-byte) buffer overflow when it
|is passed a zero length string. (Can e.g. be triggered by passing a
|"postalAddressAttribute" with the value "$" (or no value a all). What the code
|does is writing a '\0' past a 1-byte long buffer allocated on the heap. (At
|least as far as I understand it)
|
|Upstream Bug: ITS#7059
|http://www.openldap.org/its/index.cgi/Software%20Bugs?id=7059;selectid=7059
|
|This bug is present in older releases as well.
|
|I wonder if this is really security relevant as it seem the worst that might
|happen is that an authenticated user can crash the daemon. I was not able to do
|so during a short test but I guess that is just a matter of trying long enough.

Ciao, Marcus

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.