[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <201103011738.52055.rhafer@suse.de>
Date: Tue, 1 Mar 2011 17:38:51 +0100
From: Ralf Haferkamp <rhafer@...e.de>
To: oss-security@...ts.openwall.com
Cc: Vincent Danen <vdanen@...hat.com>,
Ludwig Nussel <ludwig.nussel@...e.de>
Subject: Re: CVE Request -- OpenLDAP -- two issues
Am Montag 28 Februar 2011, 17:38:43 schrieb Vincent Danen:
> * [2011-02-28 14:16:06 +0100] Thomas Biege wrote:
> >The following might also need a CVE-ID.
> >
> >https://bugzilla.novell.com/show_bug.cgi?id=674985#c1
> >---------------------------------------------------------------------
> >--------- http://www.openldap.org/its/index.cgi/Software Bugs?id=6768
> >
> >That's a pretty bad DOS. Everybody (even unauthenticated users) can
> >kill the server by submitting a MODRDN request with an empty "olddn"
> >value and "remove
> >
> >old RDN" set (-r). Example:
> > ldapmodrdn -x -H ldap://ldapserver -r '' o=test
> >
> >---------------------------------------------------------------------
> >---------
>
> I've just tried this here. I noted in your bug report that you
> indicate that it seems to affect all of your currently maintained
> products, but I've tried it here against openldap 2.3.43 and do not
> see a crash (I can reproduce the crash on 2.4.19).
It seems you are right. Even though the bug slipped into CVS HEAD already
in 2006 it never got merged into the 2.3 release branch. So only 2.4.x
releases are affected by this. Sorry for causing confusion here.
> Have you tested this one against older openldap, or is it just an
> assumption (it might be ACLs or something that is preventing me from
> seeing the crash, but I don't believe so if no authentication is
> required to affect this).
>
> Seems that this is the patch to fix it:
>
> http://www.openldap.org/devel/cvsweb.cgi/servers/slapd/modrdn.c.diff?r
> 1=1.170.2.8&r2=1.170.2.9&hideattic=1&sortbydate=0
>
> The code is different enough in 2.3.x that I can't tell by looking at
> it whether or not it is affected (enough looks similar that perhaps
> it might be and may just require a changed ldapmodrdn command).
regards,
Ralf
--
SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nuernberg)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
