Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 26 Oct 2011 16:29:35 +0200
From: Marcus Meissner <meissner@...e.de>
To: OSS Security List <oss-security@...ts.openwall.com>
Subject: Re: CVE Request: openldap2 UTF8StringNormalize() can cause a (one-byte) buffer overflow

On Wed, Oct 26, 2011 at 04:26:45PM +0200, Marcus Meissner wrote:
> Hi,

Dup from Sebastians mail, which he mailed at the same tiem.

Ciao, Marcus
 
> From our openldap2 Maintainer Ralf:
> |A bug in UTF8StringNormalize() can cause a (one-byte) buffer overflow when it
> |is passed a zero length string. (Can e.g. be triggered by passing a
> |"postalAddressAttribute" with the value "$" (or no value a all). What the code
> |does is writing a '\0' past a 1-byte long buffer allocated on the heap. (At
> |least as far as I understand it)
> |
> |Upstream Bug: ITS#7059
> |http://www.openldap.org/its/index.cgi/Software%20Bugs?id=7059;selectid=7059
> |
> |This bug is present in older releases as well.
> |
> |I wonder if this is really security relevant as it seem the worst that might
> |happen is that an authenticated user can crash the daemon. I was not able to do
> |so during a short test but I guess that is just a matter of trying long enough.
> 
> Ciao, Marcus
> 

-- 
Working, but not speaking, for the following german company:
SUSE LINUX Products GmbH, HRB 16746 (AG Nuernberg)
Geschaeftsfuehrer: Jeff Hawn, Jennifer Guild, Felix Imendoerffer

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.