openldap-bugs September 2017

openldap-bugs@openldap.org

35 participants
128 discussions

Re: (ITS#8703) slapd should create its PID file before dropping privileges
by michael＠orlitzky.com 06 Sep '17

06 Sep '17

On 09/05/2017 05:38 PM, Ryan Tandy wrote: > > If you would like to propose a patch, we could review that. For myself I > don't think I would attach a high priority to this. I understand that it's a low priority, I'm just trying to clean up the hundred or so cases of this that we have in Gentoo. In a few, it's impossible to do so because of the way the daemon creates the PID file (like it is here), so I'm doing bugs/CVEs to keep track of them. This way that distribution maintainers have something to watch and will know when they can fix their init scripts. > Howard pointed out on IRC that if the directory containing the pid file > is sticky, making it owned by root means slapd can no longer remove it > on exit. I'm not sure how common that is but it's a setup that works > right now. Typically the PID file would go directly in /run (or /var/run) and be owned by root. That means that you can't clean it up when the daemon exits, but no one expects a daemon to do that. Practically, the PID file exists solely for the benefit of init systems. Given the choice between, 1. How do I determine if I can trust the contents of this file owned by an untrusted user? 2. How do I remove the PID file after killing the daemon? the second is much easier to do. The first is next to impossible to get right; so if we have to pick one, that's the way to go IMO.

1 0

Re: (ITS#8714)
by michael＠stroeder.com 05 Sep '17

05 Sep '17

michael(a)stroeder.com wrote: > If you don't mind I just produce another follow-up patch for the > man-page. Find this man-page patch here: https://www.stroeder.com/temp/0001-ITS-8714-man-page-corrections-regarding-… Ciao, Michael.

1 0

Re: (ITS#8703) slapd should create its PID file before dropping privileges
by ryan＠openldap.org 05 Sep '17

05 Sep '17

On Fri, Jul 28, 2017 at 07:35:47PM +0000, michael(a)orlitzky.com wrote: >The slapd daemon should create its PID file before dropping privileges. This >represents a minor security issue; additional factors are needed to make it >exploitable. If I understood you correctly, "Additional factors are needed" basically means you have to find a code execution vulnerability in slapd? At that point I think you can do much more interesting things - pretending that your user is uid 0, or in various admin groups are only the first ideas that come to mind. If you would like to propose a patch, we could review that. For myself I don't think I would attach a high priority to this. Howard pointed out on IRC that if the directory containing the pid file is sticky, making it owned by root means slapd can no longer remove it on exit. I'm not sure how common that is but it's a setup that works right now.

1 0

Re: (ITS#8703) slapd should create its PID file before dropping privileges
by michael＠orlitzky.com 05 Sep '17

05 Sep '17

This has been assigned CVE-2017-14159.

1 0

Re: (ITS#8714)
by michael＠stroeder.com 05 Sep '17

05 Sep '17

Howard Chu wrote: > You could add a LIMITATIONS section, as slapd-monitor.5 and > slapd-shell.5 does. The manpage now needs an update to note that > the exop value is base64 encoded. Also, since it is encoded, I > don't believe it's necessary to explicitly send the valuelen. Ah, yes. Forgot to update the message format in the man-page. If you don't mind I just produce another follow-up patch for the man-page. Ok? Ciao, Michael.

1 0

Re: (ITS#8714)
by hyc＠symas.com 05 Sep '17

05 Sep '17

Michael Str=C3=B6der wrote: > hyc(a)symas.com wrote: >> There's a weird indent at extended.c:50 or so, the if() >> statement. >> >> Would be better to use op->o_tmpalloc instead of ber_memalloc >> since you'r=3D e=3D20 immediately freeing the buffer again anyway. >> >> I can fix those here if you don't care. >=20 > Yes, I'd highly appreciate if you simply adjust it to your coding style= . >=20 > One additional point: > Currently the external program is not able to produce a custom extended= =20 > operation response. Mainly it should always return CONTINUE or an error= =20 > response. I wanted to make this limitation clear in the man-page but wa= s=20 > unsure about the appropriate section. You could add a LIMITATIONS section, as slapd-monitor.5 and slapd-shell.5= =20 does. The manpage now needs an update to note that the exop value is base= 64=20 encoded. Also, since it is encoded, I don't believe it's necessary to=20 explicitly send the valuelen. --=20 -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#8714)
by michael＠stroeder.com 05 Sep '17

05 Sep '17

hyc(a)symas.com wrote: > There's a weird indent at extended.c:50 or so, the if() > statement. > > Would be better to use op->o_tmpalloc instead of ber_memalloc > since you'r= e=20 immediately freeing the buffer again anyway. > > I can fix those here if you don't care. Yes, I'd highly appreciate if you simply adjust it to your coding style. One additional point: Currently the external program is not able to produce a custom extended operation response. Mainly it should always return CONTINUE or an error response. I wanted to make this limitation clear in the man-page but was unsure about the appropriate section. Ciao, Michael.

1 0

Re: (ITS#8714)
by hyc＠symas.com 05 Sep '17

05 Sep '17

Michael Str=C3=B6der wrote: > Howard Chu wrote: >> Your patch is missing extended.c >=20 > Aargh! Corrected herein: >=20 > https://www.stroeder.com/temp/0001-ITS-8714-Send-out-EXTENDED-operation= -message-from-back-sock_rev3.patch=20 There's a weird indent at extended.c:50 or so, the if() statement. Would be better to use op->o_tmpalloc instead of ber_memalloc since you'r= e=20 immediately freeing the buffer again anyway. I can fix those here if you don't care. --=20 -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#8714)
by michael＠stroeder.com 05 Sep '17

05 Sep '17

This is a cryptographically signed message in MIME format. --------------ms020207030808080005010306 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: quoted-printable Howard Chu wrote: > Your patch is missing extended.c Aargh! Corrected herein: https://www.stroeder.com/temp/0001-ITS-8714-Send-out-EXTENDED-operation-m= essage-from-back-sock_rev3.patch Ciao, Michael. --------------ms020207030808080005010306 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC CucwggT9MIID5aADAgECAhBFRleVrRF8X5GwbV0tcLCgMA0GCSqGSIb3DQEBCwUAMHUxCzAJ BgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSkwJwYDVQQLEyBTdGFydENvbSBD ZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEjMCEGA1UEAxMaU3RhcnRDb20gQ2xhc3MgMSBDbGll bnQgQ0EwHhcNMTYwOTE2MDcxNjUxWhcNMTkxMjE2MDcxNjUxWjBEMR0wGwYDVQQDDBRtaWNo YWVsQHN0cm9lZGVyLmNvbTEjMCEGCSqGSIb3DQEJARYUbWljaGFlbEBzdHJvZWRlci5jb20w ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQChMBt5jtuLXsNQ5U7rBbZit8sknIwz hfaousT3d/fssQ6qZwe9l1yklILSXVMqI7/bxbiqcd3zrz+imdSlZPrFBHGfh04DZHCfss2F RwSswGejqP1qE3hPvZi96wFfOMqenpN+pSXqNJ1OPBCJ8a+8ZEioFKoEj3HkCCXjbmezAgms FuA7aFE9BfjJ2eQKw8B9G8X1FjvOTinYSZ2F+qHpKgywl4HTx0dMnYy+Pwu4DDIHkEaVH+uj K1/ed76WUEH51mX9m2Xu0onfQlSM3me6EvAAZiIDsCEbF9WttRuJbpfCFo0m2uW7BBugS7EG Jro1nRSQVnpJyTFgHb5EGMVVAgMBAAGjggG4MIIBtDAOBgNVHQ8BAf8EBAMCBLAwHQYDVR0l BBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMAkGA1UdEwQCMAAwHQYDVR0OBBYEFFh1801TSuxT Nltnv9rOjrZzUUgNMB8GA1UdIwQYMBaAFCSBbDlhvkkPj7cbRivJKLUnSG1oMG8GCCsGAQUF BwEBBGMwYTAkBggrBgEFBQcwAYYYaHR0cDovL29jc3Auc3RhcnRzc2wuY29tMDkGCCsGAQUF BzAChi1odHRwOi8vYWlhLnN0YXJ0c3NsLmNvbS9jZXJ0cy9zY2EuY2xpZW50MS5jcnQwOAYD VR0fBDEwLzAtoCugKYYnaHR0cDovL2NybC5zdGFydHNzbC5jb20vc2NhLWNsaWVudDEuY3Js MB8GA1UdEQQYMBaBFG1pY2hhZWxAc3Ryb2VkZXIuY29tMCMGA1UdEgQcMBqGGGh0dHA6Ly93 d3cuc3RhcnRzc2wuY29tLzBHBgNVHSAEQDA+MDwGCysGAQQBgbU3AQIFMC0wKwYIKwYBBQUH AgEWH2h0dHBzOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kwDQYJKoZIhvcNAQELBQADggEB AKiJ9wpjJeHdEzHDZyqmhn4cHcRj9Ag7ZQK0meq1N3oQ9M1YeVge6vZe20LXojgXsNUQGLSt 1lW2s7fABkL9CF+/RtWznHxlp4YpWX/RgbHBo3uXKNA5JUOjbxQ2+1b1jaTp/FUrSIISAxgd RpeYAODJ0db1x8Q+l66DtIVjj7ktWISdJWE2Opn4QnaRwdj6n35Rul4S2ikUsmxtGrHLpjRR XJqbsGa0RZdJyUKlZ2ZRAoRz4jKHOogQcig937sR5Ut2pGOhrScEhgARY2c8Gs2olRTL3pue mE4vjY0g1Nwr9RzeFwMuasiFh4yD34i6jIRfoNzuLPgydjsJ0grw0akwggXiMIIDyqADAgEC AhBrp4p9CteI1lEK+Vnk57ThMA0GCSqGSIb3DQEBCwUAMH0xCzAJBgNVBAYTAklMMRYwFAYD VQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0 ZSBTaWduaW5nMSkwJwYDVQQDEyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAe Fw0xNTEyMTYwMTAwMDVaFw0zMDEyMTYwMTAwMDVaMHUxCzAJBgNVBAYTAklMMRYwFAYDVQQK Ew1TdGFydENvbSBMdGQuMSkwJwYDVQQLEyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhv cml0eTEjMCEGA1UEAxMaU3RhcnRDb20gQ2xhc3MgMSBDbGllbnQgQ0EwggEiMA0GCSqGSIb3 DQEBAQUAA4IBDwAwggEKAoIBAQC9fdr3w6J9g/Zbgv3bW1+uHht1wLUZr5gkrLtXedg17Ake fMyUGwrQdvwObhajcVmnKVxhrUwkZPXRAwZZosRHfEIi5FH7x6SV/8Sp5lZEuiMnvMFG2MzL A84J6Ws5T4NfXZ0qn4TPgnr3X2vPVS51M7Ua9nIJgn8jvTra4eyyQzxvuA/GZwKg7VQfDCmC S+kICslYYWgXOMt2xlsSslxLce0CGWRsT8EpMyt1iDflSjXZIsE7m1uTyHaKZspMLyIyz6my Su8j8BWWHpChNNeTrFuhVfrOAyDPFJVUvKZCLKBhibTLloyy+LatoWELrjdI4a8StZY8+dIR 9t4APXGzAgMBAAGjggFkMIIBYDAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0lBBYwFAYIKwYBBQUH AwIGCCsGAQUFBwMEMBIGA1UdEwEB/wQIMAYBAf8CAQAwMgYDVR0fBCswKTAnoCWgI4YhaHR0 cDovL2NybC5zdGFydHNzbC5jb20vc2ZzY2EuY3JsMGYGCCsGAQUFBwEBBFowWDAkBggrBgEF BQcwAYYYaHR0cDovL29jc3Auc3RhcnRzc2wuY29tMDAGCCsGAQUFBzAChiRodHRwOi8vYWlh LnN0YXJ0c3NsLmNvbS9jZXJ0cy9jYS5jcnQwHQYDVR0OBBYEFCSBbDlhvkkPj7cbRivJKLUn SG1oMB8GA1UdIwQYMBaAFE4L7xqkQFulF2mHMMo0aEPQQa7yMD8GA1UdIAQ4MDYwNAYEVR0g ADAsMCoGCCsGAQUFBwIBFh5odHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kwDQYJKoZI hvcNAQELBQADggIBAIvj94fsAYuErQ8BAluc4SMnIwS9NPBwAm5SH9uh2NCXTq7im61g7F1L IiNI/+wq37fUuaMbz4g7VarKQTgf8ubs0p7NZWcIe7Bvem2AWaXBsxsaRTYw5kG3DN8pd1hS EUuFoTa7DmNeFe8tiK1BrL3rbA/m48jp4AiFXgvxprJrW7izsyetOrRHPbkW4Y07v29MdhaP v3u1JELyszXqOzjIYo4sWlC8iDQXwgSW/ntvWy2n4LuiaozlCfXl149tKeqvwlvrla2Yklue /quWp9j9ou4T/OY0CXMuY+B8wNK0ohd2D4ShgFlMSjzAFRoHGKF81snTr2d1A7Ew02oF6UQy CkC2aNNsK5cWOojBar5c7HplX9aHYUCZouxIeU28SONJAxnATgR4cJ2jrpmYSz/kliUJ46S6 UpVDo/ebn9c6PaM/XtDYCCaM/7XX6wc3s++sbQ7CtCn1Ax7df6ufQbwyO0V+oFa9H0KAsjHM zcwk3EV2B2NLatidKE/m7G+rB9m+FlVgIiSp0mGlg43QO9Kh1+JqvTCIzv2bJJkmPMLQJNuK KwHNL8F4GGp6jbAV+WL+LDeGfVcq8DHS3LrD+xyYEXQBiqZEdiPVOMxLDSUCXsDO0uCWpaNQ 8j6y6S9p0xE/Ga0peVLadVHhqf9nXqKaxnr358VgfrxzUIrvOaOjMYIDzDCCA8gCAQEwgYkw dTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKTAnBgNVBAsTIFN0YXJ0 Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSMwIQYDVQQDExpTdGFydENvbSBDbGFzcyAx IENsaWVudCBDQQIQRUZXla0RfF+RsG1dLXCwoDANBglghkgBZQMEAgEFAKCCAhMwGAYJKoZI hvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTcwOTA1MTM1NjA1WjAvBgkq hkiG9w0BCQQxIgQg8GCP1w5NtTSxcpwIYyPNKa+KPNyCIiZ5C20j5QlpXN0wbAYJKoZIhvcN AQkPMV8wXTALBglghkgBZQMEASowCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqGSIb3 DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBmgYJKwYB BAGCNxAEMYGMMIGJMHUxCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSkw JwYDVQQLEyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEjMCEGA1UEAxMaU3Rh cnRDb20gQ2xhc3MgMSBDbGllbnQgQ0ECEEVGV5WtEXxfkbBtXS1wsKAwgZwGCyqGSIb3DQEJ EAILMYGMoIGJMHUxCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSkwJwYD VQQLEyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEjMCEGA1UEAxMaU3RhcnRD b20gQ2xhc3MgMSBDbGllbnQgQ0ECEEVGV5WtEXxfkbBtXS1wsKAwDQYJKoZIhvcNAQEBBQAE ggEAQWsqReIlurKEhbkx577vMfgCmQaZVpXF0KGu367xj9DvBl9zN676ewWNz+H8r9bowUsX BvW5CocLPm0AyLAnsxgtIyyGX2OWci4da3dJs0Du1yjh1mjArfi/zmRVSFtKJEJgE7/dtWLF Vi/hVggifhJ/2vvvh4zQFGpi7pBeF+mv2YeUk9nrcOhVV6jr7rDyzRWXF2tvs+qv8BILtg+n vc4CnBTRL388vLzIreOAcORrUnJagh6IvRlydZyG4S2zXCBEOLwRzBkUADLqo5MmODiGuD8m X4Cnp0awozR+DYIrx6AhjzIpaCuWqoj6l3HG+6S2oNvY3ifwyH5Uj9cUHgAAAAAAAA== --------------ms020207030808080005010306--

1 0

Re: (ITS#8714)
by hyc＠symas.com 05 Sep '17

05 Sep '17

michael(a)stroeder.com wrote: > This is a multi-part message in MIME format. > --------------E329EF3D834E0A798BAC2EBC > Content-Type: text/plain; charset=UTF-8; format=flowed > Content-Transfer-Encoding: 7bit > > Find attached a new patch which base64-encoded the extended > operation request value before sending it to the socket. > > You can also download patch file here: Your patch is missing extended.c -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs September 2017