Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 1 Mar 2011 17:38:51 +0100
From: Ralf Haferkamp <>
Cc: Vincent Danen <>,
	Ludwig Nussel <>
Subject: Re: CVE Request -- OpenLDAP -- two issues

Am Montag 28 Februar 2011, 17:38:43 schrieb Vincent Danen:
> * [2011-02-28 14:16:06 +0100] Thomas Biege wrote:
> >The following might also need a CVE-ID.
> >
> >
> >---------------------------------------------------------------------
> >--------- Bugs?id=6768
> >
> >That's a pretty bad DOS. Everybody (even unauthenticated users) can
> >kill the server by submitting a MODRDN request with an empty "olddn"
> >value and "remove
> >
> >old RDN" set (-r). Example:
> >      ldapmodrdn -x -H ldap://ldapserver -r '' o=test
> >
> >---------------------------------------------------------------------
> >---------
> I've just tried this here.  I noted in your bug report that you
> indicate that it seems to affect all of your currently maintained
> products, but I've tried it here against openldap 2.3.43 and do not
> see a crash (I can reproduce the crash on 2.4.19).
It seems you are right. Even though the bug slipped into CVS HEAD already 
in 2006 it never got merged into the 2.3 release branch. So only 2.4.x 
releases are affected by this. Sorry for causing confusion here.

> Have you tested this one against older openldap, or is it just an
> assumption (it might be ACLs or something that is preventing me from
> seeing the crash, but I don't believe so if no authentication is
> required to affect this).
> Seems that this is the patch to fix it:
> 1=
> The code is different enough in 2.3.x that I can't tell by looking at
> it whether or not it is affected (enough looks similar that perhaps
> it might be and may just require a changed ldapmodrdn command).


SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nuernberg)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.