[ GLSA 200803-28 ] OpenLDAP: Denial of Service vulnerabilities

[Pierre-Yves Rofes <py () gentoo org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 200803-28
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                            http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

  Severity: Normal
     Title: OpenLDAP: Denial of Service vulnerabilities
      Date: March 19, 2008
      Bugs: #197446, #209677
        ID: 200803-28

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

Multiple Denial of Service vulnerabilities have been reported in
OpenLDAP.

Background
==========

OpenLDAP Software is an open source implementation of the Lightweight
Directory Access Protocol.

Affected packages
=================

    -------------------------------------------------------------------
     Package           /  Vulnerable  /                     Unaffected
    -------------------------------------------------------------------
  1  net-nds/openldap      < 2.3.41                          >= 2.3.41

Description
===========

The following errors have been discovered in OpenLDAP:

* Tony Blake discovered an error which exists within the
  normalisation of "objectClasses" (CVE-2007-5707).

* Thomas Sesselmann reported that, when running as a proxy-caching
  server the "add_filter_attrs()" function in
  servers/slapd/overlay/pcache.c does not correctly NULL terminate
  "new_attrs" (CVE-2007-5708).

* A double-free bug exists in attrs_free() in the file
  servers/slapd/back-bdb/modrdn.c, which was discovered by Jonathan
  Clarke (CVE-2008-0658).

Impact
======

A remote attacker can cause a Denial of Serivce by sending a malformed
"objectClasses" attribute, and via unknown vectors that prevent the
"new_attrs" array from being NULL terminated, and via a modrdn
operation with a NOOP (LDAP_X_NO_OPERATION) control.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All OpenLDAP users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=net-nds/openldap-2.3.41"

References
==========

  [ 1 ] CVE-2007-5707
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5707
  [ 2 ] CVE-2007-5708
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5708
  [ 3 ] CVE-2008-0658
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0658

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

  http://security.gentoo.org/glsa/glsa-200803-28.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security () gentoo org or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2008 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.7 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFH4ZoCuhJ+ozIKI5gRAuZYAKCXAX4sXc39JTd83l6VwVfnHdMsZACfQVfi
kTrjdz99Vifw47to09cOknQ=
=0mt1
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/