Bugzilla Bug 197446

Some vulnerabilities have been reported in OpenLDAP, which can be
exploited by malicious users to cause a DoS (Denial of Service).

1) A vulnerability is caused due to the "add_filter_attrs()" function
in servers/slapd/overlay/pcache.c not correctly NULL terminating
"new_attrs", which can be exploited to crash slapd due to an out of
bounds memory access.

Successful exploitation may require that slapd runs as proxy-caching
server.

2) An error within the normalisation of "objectClasses" can be
exploited to crash a vulnerable server by sending a malformed
"objectClasses" attribute.

The vulnerabilities are reported in versions prior to 2.3.39.

Note: Several other bugs, which may have a security impact, were also
reported.

SOLUTION:
Update to version 2.3.39.

2.3.39 has been added to the tree a few hours ago. Is this version ready to be
stabilised? ldap team, please advise.

do it :)

arches please use the testkit with overlays useflag set (and without if you
feel like spending more time)

well given that it's only just been added and we haven't filed a stabilization
bug i'd guess it's NOT ready to be stabilized. In light of the advisory though
we can probably speed it up. Having read all the advisories though, it doesn't
seem to be a major issue, in fact contrary to what I saw some classify the bug
as, it does require special compile configuration and authorized access to add
things to the DIT. In other words the impact is lessened considerably if you
are running a normal recommended setup where you don't allow anonymous people
to make modifications to your LDAP backend. I'll see if I can get hold of
robbat / jokey and find out there thoughts, we'll look to stabilize it soon
though.

markus your overlay use flag still breaks all the syncrepl stuff. I'd like to
fix it before we push it out. I'll catch you on irc.

ok, ping security back when it's ready.

*** Bug 195180 has been marked as a duplicate of this bug. ***

After ~arch for a week, how is it doing?

Enabled the syncprov overlay now by default so that it works sanely with
new-style config system with 2.3.39-r1

Is this ready for stabling now?

Jokey, I remember you OK'ed the stabling in a recent chat, but I lost the logs.
Can you confirm that again, please?

Yup, just go ahead for now, the bdb issue will be dealt with at a different
version

Arches, please test and mark stable net-nds/openldap-2.3.39-r1.
Target keywords : "alpha amd64 arm hppa ia64 ppc ppc64 s390 sh sparc x86"

*sigh* you'll need a emul-linux-x86-baselibs bump too...

(In reply to comment #13)
> *sigh* you'll need a emul-linux-x86-baselibs bump too...

copy that sigh.

ppc stable

ppc64 stable

Stable for HPPA.

x86 stable

alpha/ia64/sparc stable

(In reply to comment #14)
> (In reply to comment #13)
> > *sigh* you'll need a emul-linux-x86-baselibs bump too...
> 
> copy that sigh.
> 

app-emulation/emul-linux-x86-baselibs-20071128 going in the tree in an hour
contains the fix.

amd64 done...

vote is open.

Vulnerability (1) does not affect the default configuration and vulnerability
(2) only allows *authenticated* users to crash the server.

I still tend to vote YES here.

I vote YES.

full YES then and filed.

GLSA 200803-28