GLSA 200403-12: OpenLDAP DoS Vulnerability
Posted on: 03/31/2004 07:01 AM

An OpenLDAP updated has been released for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200403-12
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: OpenLDAP DoS Vulnerability
Date: March 31, 2004
Bugs: #26728
ID: 200403-12

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======

A failed password operation can cause the OpenLDAP slapd server, if it is using the back-ldbm backend, to free memory that was never allocated.

Background
=========

OpenLDAP is a suite of LDAP-related application and development tools. It includes slapd (the standalone LDAP server), slurpd (the standalone LDAP replication server), and various LDAP libraries, utilities and example clients.

Affected packages
================

-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
net-nds/openldap <= 2.1.12 >= 2.1.13

Description
==========

A password extended operation (password EXOP) which fails will cause the slapd server to free() an uninitialized pointer, possibly resulting in a segfault. This only affects servers using the back-ldbm backend.

Such a crash is not guaranteed with every failed operation, however, it is possible.

Impact
=====

An attacker (or indeed, a normal user) may crash the OpenLDAP server, creating a Denial of Service condition.

Workaround
=========

A workaround is not currently known for this issue. All users are advised to upgrade to the latest version of the affected package.

Resolution
=========

OpenLDAP users should upgrade to version 2.1.13 or later:

# emerge sync

# emerge -pv ">=net-nds/openldap-2.1.13"
# emerge ">=net-nds/openldap-2.1.13"

References
=========

[ 1 ] http://www.openldap.org/its/index.cgi?findid=2390

Concerns?
========

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at http://bugs.gentoo.org.


Printed from Linux Compatible (http://www.linuxcompatible.org/news/story/glsa_200403_12_openldap_dos_vulnerability.html)