------=_Part_8120_20176863.1164676496288 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline
Hello,
It would appear from my testing that this bug is not fixed. I have compiled and installed 2.3.30 and verified that my version of getdn.c (1.124.2.5) has the fixes that were introduced in 1.134. However, a nessus scan that attempts to exploit this bug still succeeds in crashing slapd, with debug output attached below (I've snipped the actual data passsed in, suffice to say it's 255 0x20's).
I'm happy to provide any other information as needed. I've taken a look at the diffs but haven't been able to find what the problem is.
Brian
ber_scanf fmt (}}) ber: ber_dump: buf=0x09efba28 ptr=0x09efbe47 end=0x09efbe47 len=0
dnPrettyNormal: <>
<<< dnPrettyNormal: <>, <> do_sasl_bind: dn () mech CRAM-MD5 ==> sasl_bind: dn="" mech=<continuing> datalen=1024 SASL Canonicalize [conn=21]: authcid=" " slap_sasl_getdn: conn 21 id= [len=255] => ldap_dn2bv(16) <= ldap_dn2bv(uid=\20 \20,cn=CRAM-MD5,cn=auth)=0 slap_sasl_getdn: u:id converted to uid=\20 \20,cn=CRAM-MD5,cn=auth
dnNormalize:
<uid=\20 \20,cn=CRAM-MD5,cn=auth> => ldap_bv2dn(uid=\20 \20,cn=CRAM-MD5,cn=auth,0) <= ldap_bv2dn(uid=\20 \20,cn=CRAM-MD5,cn=auth)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=\20,cn=cram-md5,cn=auth)=0 <<< dnNormalize: <uid=\20,cn=cram-md5,cn=auth> ==>slap_sasl2dn: converting SASL name uid=\20,cn=cram-md5,cn=auth to a DN slap_authz_regexp: converting SASL name uid=\20,cn=cram-md5,cn=auth <==slap_sasl2dn: Converted SASL name to <nothing> SASL Canonicalize [conn=21]: slapAuthcDN="uid=\20,cn=cram-md5,cn=auth"
------=_Part_8120_20176863.1164676496288 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Content-Disposition: inline
Hello,<br><br>It would appear from my testing that this bug is not fixed. I= have compiled and installed 2.3.30 and verified that my version of getdn.c= (<a href=3D"http://1.124.2.5%22%3E1.124.2.5</a>) has the fixes that were intro= duced in=20 1.134. However, a nessus scan that attempts to exploit this bug still succe= eds in crashing slapd, with debug output attached below (I've snipped the a= ctual data passsed in, suffice to say it's 255 0x20's). <br><br>I'm happy t= o provide any other information as needed. I've taken a look at the diffs b= ut haven't been able to find what the problem is. <br><br>Brian<br><br>ber_scanf fmt (}}) ber:<br>ber_dump: buf=3D0x09efba28 = ptr=3D0x09efbe47 end=3D0x09efbe47 len=3D0<br><br>>>> dnPrettyNorma= l: <><br><<< dnPrettyNormal: <>, <><br>do_sasl_b= ind: dn () mech CRAM-MD5 <br>=3D=3D> sasl_bind: dn=3D"" mech=3D<continuing> datal= en=3D1024<br>SASL Canonicalize [conn=3D21]: authcid=3D" &nb= sp; = &nb= sp; = &nb= sp; = &nb= sp; = &nb= sp; = &nb= sp; = &nb= sp; = &nb= sp; = &nb= sp; = &nb= sp; = &nb= sp; = &nb= sp; = &nb= sp; = &nb= sp; = &nb= sp; = &nb= sp; = &nb= sp; = &nb= sp; = &nb= sp; = &nb= sp; = &nb= sp; = &nb= sp; = &nb= sp; = &nb= sp; = &nb= sp; = &nb= sp; = &nb= sp; = &nb= sp; = &nb= sp; = &nb= sp; = &nb= sp; = &nb= sp; = &nb= sp; = &nb= sp; = &nb= sp; = &nb= sp; = &nb= sp; = &nb= sp; = &nb= sp; = &nb= sp; = &nb= sp; = " <br>slap_sasl_getdn: conn 21 id=3D  = ; &n= bsp;  = ; &n= bsp;  = ; &n= bsp;  = ; &n= bsp;  = ; &n= bsp;  = ; &n= bsp;  = ; &n= bsp;  = ; &n= bsp;  = ; &n= bsp;  = ; &n= bsp;  = ; &n= bsp;  = ; &n= bsp;  = ; &n= bsp;  = ; &n= bsp;  = ; &n= bsp;  = ; &n= bsp;  = ; &n= bsp;  = ; &n= bsp;  = ; &n= bsp;  = ; &n= bsp;  = ; &n= bsp;  = ; &n= bsp;  = ; &n= bsp;  = ; &n= bsp;  = ; &n= bsp;  = ; &n= bsp;  = ; &n= bsp;  = ; &n= bsp;  = ; &n= bsp;  = ; &n= bsp;  = ; &n= bsp;  = ; &n= bsp;  = ; &n= bsp;  = ; &n= bsp;  = ; &n= bsp;  = ; &n= bsp;  = ; &n= bsp;  = ; &n= bsp;  = ; &n= bsp;  = ; &n= bsp;  = ; &n= bsp; [len=3D255] <br>=3D> ldap_dn2bv(16)<br><=3D ldap_dn2bv(uid=3D\20  = ; &n= bsp;  = ; &n= bsp;  = ; &n= bsp;  = ; &n= bsp;  = ; &n= bsp;  = ; &n= bsp;  = ; &n= bsp;  = ; &n= bsp;  = ; &n= bsp;  = ; &n= bsp; \20,= cn=3DCRAM-MD5,cn=3Dauth)=3D0 <br>slap_sasl_getdn: u:id converted to uid=3D\20 &nb= sp; = &nb= sp; = &nb= sp; = &nb= sp; = &nb= sp; = &nb= sp; = &nb= sp; = &nb= sp; = &nb= sp; = &nb= sp; = \20,cn=3DCRAM-= MD5,cn=3Dauth <br>>>> dnNormalize: <uid=3D\20 &n= bsp;  = ; &n= bsp;  = ; &n= bsp;  = ; &n= bsp;  = ; &n= bsp;  = ; &n= bsp;  = ; &n= bsp;  = ; &n= bsp;  = ; &n= bsp;  = ; &n= bsp;  = ; \20,cn=3DCRAM-MD5,c= n=3Dauth> <br>=3D> ldap_bv2dn(uid=3D\20 &= nbsp; &nbs= p; &= nbsp; &nbs= p; &= nbsp; &nbs= p; &= nbsp; &nbs= p; &= nbsp; &nbs= p; &= nbsp; &nbs= p; &= nbsp; &nbs= p; &= nbsp; &nbs= p; &= nbsp; &nbs= p; &= nbsp; &nbs= p; \20,cn=3DCRAM-MD5,cn=3Dauth,0) <br><=3D ldap_bv2dn(uid=3D\20 &= nbsp; &nbs= p; &= nbsp; &nbs= p; &= nbsp; &nbs= p; &= nbsp; &nbs= p; &= nbsp; &nbs= p; &= nbsp; &nbs= p; &= nbsp; &nbs= p; &= nbsp; &nbs= p; &= nbsp; &nbs= p; &= nbsp; &nbs= p; \20,cn=3DCRAM-MD5,cn=3Dauth)= =3D0 <br>=3D> ldap_dn2bv(272)<br><=3D ldap_dn2bv(uid=3D\20,cn=3Dcram-md5,c= n=3Dauth)=3D0<br><<< dnNormalize: <uid=3D\20,cn=3Dcram-md5,cn= =3Dauth><br>=3D=3D>slap_sasl2dn: converting SASL name uid=3D\20,cn=3D= cram-md5,cn=3Dauth to a DN <br>slap_authz_regexp: converting SASL name uid=3D\20,cn=3Dcram-md5,cn=3Dau= th<br><=3D=3Dslap_sasl2dn: Converted SASL name to <nothing><br>SAS= L Canonicalize [conn=3D21]: slapAuthcDN=3D"uid=3D\20,cn=3Dcram-md5,cn= =3Dauth"<br> <br><br><br>
------=_Part_8120_20176863.1164676496288--