Re: CVE Request -- OpenLDAP -- two issues

[Ralf Haferkamp <rhafer () suse de>]

Am Montag 28 Februar 2011, 17:38:43 schrieb Vincent Danen:
> * [2011-02-28 14:16:06 +0100] Thomas Biege wrote:
> > The following might also need a CVE-ID.
> >
> > https://bugzilla.novell.com/show_bug.cgi?id=674985#c1
> > ---------------------------------------------------------------------
> > --------- http://www.openldap.org/its/index.cgi/Software Bugs?id=6768
> >
> > That's a pretty bad DOS. Everybody (even unauthenticated users) can
> > kill the server by submitting a MODRDN request with an empty "olddn"
> > value and "remove
> >
> > old RDN" set (-r). Example:
> >      ldapmodrdn -x -H ldap://ldapserver -r '' o=test
> >
> > ---------------------------------------------------------------------
> > ---------
>
> I've just tried this here.  I noted in your bug report that you
> indicate that it seems to affect all of your currently maintained
> products, but I've tried it here against openldap 2.3.43 and do not
> see a crash (I can reproduce the crash on 2.4.19).
It seems you are right. Even though the bug slipped into CVS HEAD already 
in 2006 it never got merged into the 2.3 release branch. So only 2.4.x 
releases are affected by this. Sorry for causing confusion here.

> Have you tested this one against older openldap, or is it just an
> assumption (it might be ACLs or something that is preventing me from
> seeing the crash, but I don't believe so if no authentication is
> required to affect this).
>
> Seems that this is the patch to fix it:
>
> http://www.openldap.org/devel/cvsweb.cgi/servers/slapd/modrdn.c.diff?r
> 1=1.170.2.8&r2=1.170.2.9&hideattic=1&sortbydate=0
>
> The code is different enough in 2.3.x that I can't tell by looking at
> it whether or not it is affected (enough looks similar that perhaps
> it might be and may just require a changed ldapmodrdn command).

regards,
        Ralf

-- 
SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nuernberg)