openldap-bugs

openldap-bugs@openldap.org

1 participants
20960 discussions

Re: (ITS#7784) Client stores bindpw in cleartext
by hyc＠symas.com 14 Jan '14

14 Jan '14

ylau(a)huawei.com wrote: > Full_Name: Yo Lau > Version: 2.3.32 > OS: SUSE Linux Enterprise Server 10 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (12.130.146.228) > OpenLDAP 2.3.32 is over 6 years old and long since unsupported. nss_ldap is not a piece of OpenLDAP software. Contact SuSE for support, this ITS will be closed. > When nss_ldap uses LDAP authentication with binding method, the bindpw stored in > ldap.conf is clear text. > However on Solaris NS_LDAP_BINDPASSWD could be stored in encrypted string. There > is no password obfuscation with nss_ldap. > So we considered it is a security issue and will affect the result of security > audit. > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#7784) Client stores bindpw in cleartext
by ylau＠huawei.com 14 Jan '14

14 Jan '14

Full_Name: Yo Lau Version: 2.3.32 OS: SUSE Linux Enterprise Server 10 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (12.130.146.228) When nss_ldap uses LDAP authentication with binding method, the bindpw stored in ldap.conf is clear text. However on Solaris NS_LDAP_BINDPASSWD could be stored in encrypted string. There is no password obfuscation with nss_ldap. So we considered it is a security issue and will affect the result of security audit.

1 0

Re: (ITS#7778) Index and derived attribute bug
by hyc＠symas.com 13 Jan '14

13 Jan '14

yann.cezard(a)univ-pau.fr wrote: > Full_Name: Yann Cezard > Version: 2.4.38 > OS: Debian GNU/Linux Wheezy / amd64 > URL: ftp://ftp.openldap.org/incoming/Yann-Cezard-130109.tgz > Submission from: (NULL) (2001:660:6701:14:225:64ff:fe92:685b) > > > Hello, > > I hit a bug with the latest version of OpenLDAP (2.4.38) that was not present, > at least in 2.4.17 (made a test on an older server that we were using before I > discovered this). > This happens on both lmdb and bdb backend (as we were using BDB before upgrading > to 2.4.38, I tested with both on 2.4.38 to ensure that the problem was not LMDB > related). > The only ways to make the '(mail=*)' filter matches again the modified entry, is > to modify the mail attribute, or to run slapindex. > If you remove the index on the mail attribute, then there is no such problem. > It only happens when deleting all/the last derived attributes (supannAutreMail > here) from the entry. > > Sounds to me like a bug, isn't it ? Thanks for the report, fixed now in git master. > > Regards. > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7783) tlsm_ctx_free crashes if ctx->tc_pin_file is null
by hyc＠symas.com 12 Jan '14

12 Jan '14

chris.w.martin(a)oracle.com wrote: > Full_Name: Chris Martin > Version: 2.4.23-32.el6_4.1 but also present in git repository version > OS: Oracle Linux 6 > URL: > Submission from: (NULL) (148.87.19.206) > > > If tlsm_ctx_free is entered with ctx->tc_pin_file null it will crash when it > calls PL_strfree with that null pointer. > > http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=blob;f=libraries/… > 2039 static void > 2040 tlsm_ctx_free ( tls_ctx *ctx ) > 2041 { > ... > 2069 PL_strfree( c->tc_pin_file ) > > I propose that an "if ( c->tc_pin_file )" be added before this line to protect > against this. > > > The specific use case when we hit this involves automount calling openldap > ldap_start_tls_s which fails with LDAP_CONNECT_ERROR. automount then calls > openldap ldap_unbind_ext which calls ldap_ld_free which calls > ldap_int_tls_destroy which triggers this crash above. Thanks for the report. This is now fixed in git master, plus another potential instance of the same issue. You guys are crazy to even be using this MozNSS POS. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7778) Index and derived attribute bug
by quanah＠zimbra.com 11 Jan '14

11 Jan '14

--On Thursday, January 09, 2014 2:55 PM +0000 yann.cezard(a)univ-pau.fr wrote: > Full_Name: Yann Cezard > Version: 2.4.38 > OS: Debian GNU/Linux Wheezy / amd64 > URL: ftp://ftp.openldap.org/incoming/Yann-Cezard-130109.tgz > Submission from: (NULL) (2001:660:6701:14:225:64ff:fe92:685b) > > > Hello, > > I hit a bug with the latest version of OpenLDAP (2.4.38) that was not > present, at least in 2.4.17 (made a test on an older server that we were > using before I discovered this). > This happens on both lmdb and bdb backend (as we were using BDB before > upgrading to 2.4.38, I tested with both on 2.4.38 to ensure that the > problem was not LMDB related). <hbf> ITS#7778: Broken in 2.4.37 by 96f35c08944a "ITS#7329 optimize index update for simple add". -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

(ITS#7783) tlsm_ctx_free crashes if ctx->tc_pin_file is null
by chris.w.martin＠oracle.com 10 Jan '14

10 Jan '14

Full_Name: Chris Martin Version: 2.4.23-32.el6_4.1 but also present in git repository version OS: Oracle Linux 6 URL: Submission from: (NULL) (148.87.19.206) If tlsm_ctx_free is entered with ctx->tc_pin_file null it will crash when it calls PL_strfree with that null pointer. http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=blob;f=libraries/… 2039 static void 2040 tlsm_ctx_free ( tls_ctx *ctx ) 2041 { ... 2069 PL_strfree( c->tc_pin_file ) I propose that an "if ( c->tc_pin_file )" be added before this line to protect against this. The specific use case when we hit this involves automount calling openldap ldap_start_tls_s which fails with LDAP_CONNECT_ERROR. automount then calls openldap ldap_unbind_ext which calls ldap_ld_free which calls ldap_int_tls_destroy which triggers this crash above.

1 0

Re: AW: (ITS#7249) slapd segfault with memberof overlay on frontend db
by michael＠stroeder.com 10 Jan '14

10 Jan '14

harald.winkelmann(a)bertschinnovation.com wrote: >> Why do you report issues for a release which is almost two years old without trying to reproduce it with a current release before? > > This is the actual openldap version distributed with the actual debian stable version (wheezy). Whatever Debian considers "stable" (for what definition?) is not relevant for OpenLDAP. Personally I consider the Debian packages rather unmaintained. Ciao, Michael.

1 0

AW: (ITS#7249) slapd segfault with memberof overlay on frontend db
by harald.winkelmann＠bertschinnovation.com 10 Jan '14

10 Jan '14

>Why do you report issues for a release which is almost two years old without trying to reproduce it with a current release before? This is the actual openldap version distributed with the actual debian stable version (wheezy). I just made a full dist-upgrade and run into this problem. This thread is still active. So... Harry

1 0

Re: (ITS#7249) slapd segfault with memberof overlay on frontend db
by michael＠stroeder.com 10 Jan '14

10 Jan '14

harald.winkelmann(a)bertschinnovation.com wrote: > Debian Wheezy > openldap_2.4.31 Why do you report issues for a release which is almost two years old without trying to reproduce it with a current release before? Ciao, Michael.

1 0

Re: (ITS#7249) slapd segfault with memberof overlay on frontend db
by harald.winkelmann＠bertschinnovation.com 10 Jan '14

10 Jan '14

--_000_30c408c19b944a1a837b407b026fe1afAMSPR01MB050eurprd01pro_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hello, is anybody working on this issue? I've the same problem. I tried the following patch and it works for me. Why isn't it applied here. https://bugs.archlinux.org/task/38137?getfile=3D11329 Debian Wheezy openldap_2.4.31 # Schema and objectClass definitions include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel none modulepath /usr/lib/ldap moduleload back_bdb moduleload memberof.la overlay memberof ####################################################################### # Specific Backend Directives for @BACKEND@: # Backend specific directives apply to this backend until another # 'backend' directive occurs backend bdb With friendly regards Harald Winkelmann Software Development DAM Group GmbH Planckstra=DFe 7 88677 Markdorf --_000_30c408c19b944a1a837b407b026fe1afAMSPR01MB050eurprd01pro_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable <html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr= osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" = xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:= //www.w3.org/TR/REC-html40"> <head> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Diso-8859-= 1"> <meta name=3D"Generator" content=3D"Microsoft Word 14 (filtered medium)"> <style></style> </head> <body lang=3D"DE" link=3D"blue" vlink=3D"purple"> <div class=3D"WordSection1"> Hello,<o:p></o:p> <o:p> </o:p> is anybody working on this issu= e?<o:p></o:p> I’ve the same problem.<o:= p></o:p> I tried the following patch and= it works for me. Why isn’t it applied here.<o:p></o:p> <a href=3D"https://bugs.archlin= ux.org/task/38137?getfile=3D11329">https://bugs.archlinux.org/task/38137?ge= tfile=3D11329</a><o:p></o:p> <o:p> </o:p> Debian Wheezy<o:p></o:p>= openldap_2.4.31<o:p></o:p></spa= n> <o:p> </o:p> # Schema and objectClass defini= tions<o:p></o:p> include    =      /etc/ldap/schema/core.schema<o:p></o:p> include    =      /etc/ldap/schema/cosine.schema<o:p></o:p></= p> include       &nb= sp; /etc/ldap/schema/nis.schema<o:p></o:p> include       &nb= sp; /etc/ldap/schema/inetorgperson.schema<o:p></o:p> <o:p> </o:p> pidfile    =      /var/run/slapd/slapd.pid<o:p></o:p> argsfile   &nbsp= ;    /var/run/slapd/slapd.args<o:p></o:p> loglevel   &nbsp= ;    none<o:p></o:p> <o:p> </o:p> modulepath   &nb= sp;  /usr/lib/ldap<o:p></o:p> moduleload   &nb= sp;  back_bdb<o:p></o:p> moduleload   &nb= sp;  memberof.la<o:p></o:p> overlay memberof<o:p></o:p></sp= an> <o:p> </o:p> ###############################= ########################################<o:p></o:p> # Specific Backend Directives f= or @BACKEND@:<o:p></o:p> # Backend specific directives a= pply to this backend until another<o:p></o:p> # 'backend' directive occurs<o:= p></o:p> backend    =      bdb<o:p></o:p> <o:p> </o:p> <o:p> </o:p> With friendly regards<o:p></o:p></= span> Harald Winkelmann<o:p></o:p></span= > Software Development<o:p></o:p></s= pan> <o:p> </o:p> DAM Group GmbH<o:p></o:p= > Planckstra=DFe 7<o:p></o:p> 88677 Markdorf<o:p></o:p> <o:p> </o:p> </div> </body> </html> --_000_30c408c19b944a1a837b407b026fe1afAMSPR01MB050eurprd01pro_--

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs