oss-security - Re: openldap DoS

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Mon, 30 Jun 2008 13:19:22 -0400
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
cc: coley@...re.org
Subject: Re: openldap DoS

On 30 June 2008, Ludwig Nussel wrote:
> Hi,
> 
> Remote unauthenticated attackers can trigger an assertion in the ASN.1 BER
> decoding of openlap and crash the server:
> http://www.openldap.org/its/index.cgi/Software%20Bugs?id=5580;selectid=5580
> 

The patch is here it seems:
http://www.openldap.org/devel/cvsweb.cgi/libraries/liblber/io.c.diff?r1=1.120&r2=1.121&hideattic=1&sortbydate=0

I'm adding Steve Christey to the CC for a CVE id.

Thanks.

-- 
    JB

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.