Lucene search

K
archlinuxArch LinuxASA-201509-4
HistorySep 12, 2015 - 12:00 a.m.

openldap: denial of service

2015-09-1200:00:00
Arch Linux
lists.archlinux.org
18

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.947 High

EPSS

Percentile

99.0%

By sending a crafted packet, an attacker can cause the OpenLDAP daemon
to crash with a SIGABRT. This is due to an assert() call within the
ber_get_next method (io.c line 682) that is hit when decoding tampered
BER data.
The following proof of concept exploit can be used to trigger the condition:

echo "/4SEhISEd4MKYj5ZMgAAAC8=" | base64 -d | nc -v 127.0.0.1 389

The above causes slapd to abort as follows when running with ‘-d3’,
however it should be noted that this will crash the server even when
running in daemon mode.

OSVersionArchitecturePackageVersionFilename
anyanyanyopenldap< 2.4.42-2UNKNOWN

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.947 High

EPSS

Percentile

99.0%