Re: CVE Request -- OpenLDAP -- two issues

[Vincent Danen <vdanen () redhat com>]

* [2011-03-01 17:38:51 +0100] Ralf Haferkamp wrote:

> Am Montag 28 Februar 2011, 17:38:43 schrieb Vincent Danen:
> > * [2011-02-28 14:16:06 +0100] Thomas Biege wrote:
> > >The following might also need a CVE-ID.
> > >
> > >https://bugzilla.novell.com/show_bug.cgi?id=674985#c1
> > >---------------------------------------------------------------------
> > >--------- http://www.openldap.org/its/index.cgi/Software Bugs?id=6768
> > >
> > >That's a pretty bad DOS. Everybody (even unauthenticated users) can
> > >kill the server by submitting a MODRDN request with an empty "olddn"
> > >value and "remove
> > >
> > >old RDN" set (-r). Example:
> > >      ldapmodrdn -x -H ldap://ldapserver -r '' o=test
> > >
> > >---------------------------------------------------------------------
> > >---------
> >
> > I've just tried this here.  I noted in your bug report that you
> > indicate that it seems to affect all of your currently maintained
> > products, but I've tried it here against openldap 2.3.43 and do not
> > see a crash (I can reproduce the crash on 2.4.19).
> It seems you are right. Even though the bug slipped into CVS HEAD already
> in 2006 it never got merged into the 2.3 release branch. So only 2.4.x
> releases are affected by this. Sorry for causing confusion here.

Thanks for that clarification, Ralf.

--
Vincent Danen / Red Hat Security Response Team