TITLE: OpenLDAP BIND Denial of Service Vulnerability SECUNIA ADVISORY ID: SA22750 VERIFY ADVISORY: http://secunia.com/advisories/22750/ CRITICAL: Moderately critical IMPACT: DoS WHERE: From remote SOFTWARE: OpenLDAP 2.2.x http://secunia.com/product/5319/ OpenLDAP 2.1.x http://secunia.com/product/1831/ DESCRIPTION: Evgeny Legerov has reported a vulnerability in OpenLDAP, which can be exploited by malicious people to cause a DoS (Denial of Service). The vulnerability is caused due to an error when processing certain BIND requests. This can be exploited to cause a crash by sending specially crafted BIND requests to an OpenLDAP server. The vulnerability is reported in OpenLDAP version 2.2.29. Other versions may also be affected. SOLUTION: Restrict access to trusted people only. PROVIDED AND/OR DISCOVERED BY: Evgeny Legerov
*** Bug 154350 has been marked as a duplicate of this bug. ***
corresponding exploit: http://lists.grok.org.uk/pipermail/full-disclosure/2006-November/050563.html
http://www.openldap.org/its/index.cgi/Software%20Bugs?id=4740 fix available in upstream cvs
ldap-bugs please advise.
[07:17] <robbat2> it's more that the patch that upstream put in for the 2.3 series totally doesn't apply to the old versions (of 2.3) Mandriva has released patches for 2.2 in corporate and 2.3 in 2006. Padawans could you locate them, robbat2 is very short on time and so am I?
Created attachment 102447 [details, diff] openldap-2.3.27-CVE-2006-5779.patch CVE-2006-5779 fix
Thx Eduardo.
Arches, please stabilize the following: required: openldap-2.3.27-r3 - target: alpha amd64 arm hppa ia64 mips ppc ppc64 sparc x86 AT LEAST ONE of: openldap-2.2.28-r5 openldap-2.2.28-r6* - target: alpha amd64 arm hppa ia64 mips ppc ppc64 s390 sh sparc x86 AT LEAST ONE of: openldap-2.1.30-r8 openldap-2.1.30-r9* - target: alpha amd64 hppa ppc ppc64 sparc x86 The *d versions contain features that had not seen stable in that major version previously, but do exist in newer major versions as stable, and have been in the tree for much longer than 30 days.
Thx Robbat.
Marked openldap-2.3.27-r3, openldap-2.2.28-r5, & openldap-2.1.30-r8 ppc64 stable. On the 2.2 and 2.1 series, the tests failed citing broken shared libraries on slapd. I checked and previous versions exhibited this behavior as well. When emerging without the tests, compilation seemed fine. Also, slapd started without error. Any ideas on the tests and do other archs see similar behavior?
net-nds/openldap-2.1.30-r8 USE="berkdb crypt gdbm ipv6 perl readline samba ssl tcpd -debug -odbc -sasl (-selinux) -slp" 1. emerges on x86, please note: /usr/portage/net-nds/openldap/openldap-2.1.30-r8.ebuild: line 103: cd: /var/tmp/portage/openldap-2.1.30-r8/work//var/tmp/portage/openldap-2.1.30-r8/work/openldap-2.1.30: No such file or directory and QA Notice: pre-stripped files found: /var/tmp/portage/openldap-2.1.30-r8/image/usr/lib/openldap/slapd /var/tmp/portage/openldap-2.1.30-r8/image/usr/lib/openldap/slurpd /var/tmp/portage/openldap-2.1.30-r8/image/usr/bin/ldapsearch /var/tmp/portage/openldap-2.1.30-r8/image/usr/bin/ldapmodify /var/tmp/portage/openldap-2.1.30-r8/image/usr/bin/ldapdelete /var/tmp/portage/openldap-2.1.30-r8/image/usr/bin/ldapmodrdn /var/tmp/portage/openldap-2.1.30-r8/image/usr/bin/ldappasswd /var/tmp/portage/openldap-2.1.30-r8/image/usr/bin/ldapwhoami /var/tmp/portage/openldap-2.1.30-r8/image/usr/bin/ldapcompare /var/tmp/portage/openldap-2.1.30-r8/image/usr/bin/ldapadd /var/tmp/portage/openldap-2.1.30-r8/image/usr/sbin/slapadd /var/tmp/portage/openldap-2.1.30-r8/image/usr/sbin/slapcat /var/tmp/portage/openldap-2.1.30-r8/image/usr/sbin/slapindex /var/tmp/portage/openldap-2.1.30-r8/image/usr/sbin/slappasswd 2. passes collision test 3. fails test suite: Waiting 5 seconds for slapd to start... ./scripts/test000-rootdse: line 57: kill: (15449) - No such process /var/tmp/portage/openldap-2.1.30-r8/work/openldap-2.1.30/clients/tools/.libs/lt-ldapsearch: error while loading shared libraries: libldap.so.2: cannot open shared object file: No such file or directory >>>>> Test failed 4. but seems to work, downgraded to this version and revdep-rebuild rebuilt the broken packages successfully Portage 2.1.1-r2 (default-linux/x86/2006.1/desktop, gcc-4.1.1, glibc-2.4-r4, 2.6.18.2 i686) ================================================================= System uname: 2.6.18.2 i686 Genuine Intel(R) CPU T2300 @ 1.66GHz Gentoo Base System version 1.12.6 Last Sync: Tue, 21 Nov 2006 19:00:01 +0000 ccache version 2.3 [disabled] app-admin/eselect-compiler: [Not Present] dev-java/java-config: 1.3.7, 2.0.30 dev-lang/python: 2.3.5-r3, 2.4.3-r4 dev-python/pycrypto: 2.0.1-r5 dev-util/ccache: 2.3 dev-util/confcache: [Not Present] sys-apps/sandbox: 1.2.17 sys-devel/autoconf: 2.13, 2.60 sys-devel/automake: 1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2 sys-devel/binutils: 2.16.1-r3 sys-devel/gcc-config: 1.3.13-r4 sys-devel/libtool: 1.5.22 virtual/os-headers: 2.6.17-r1 ACCEPT_KEYWORDS="x86" AUTOCLEAN="yes" CBUILD="i686-pc-linux-gnu" CFLAGS="-O2 -march=prescott -pipe -fomit-frame-pointer" CHOST="i686-pc-linux-gnu" CONFIG_PROTECT="/etc /usr/kde/3.5/env /usr/kde/3.5/share/config /usr/kde/3.5/shutdown /usr/share/X11/xkb /usr/share/config /var/qmail/alias /var/qmail/control" CONFIG_PROTECT_MASK="/etc/env.d /etc/env.d/java/ /etc/gconf /etc/java-config/vms/ /etc/revdep-rebuild /etc/terminfo /etc/texmf/web2c" CXXFLAGS="-O2 -march=prescott -pipe -fomit-frame-pointer" DISTDIR="/usr/portage/distfiles" EMERGE_DEFAULT_OPTS="--nospinner" FEATURES="autoconfig collision-protect distlocks metadata-transfer parallel-fetch sandbox sfperms strict test userfetch userpriv usersandbox" GENTOO_MIRRORS="http://mirror.switch.ch/mirror/gentoo/ http://gentoo.inode.at/" LINGUAS="en de en_GB de_CH" MAKEOPTS="-j3" PKGDIR="/usr/portage/packages" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --delete-after --stats --timeout=180 --exclude='/distfiles' --exclude='/local' --exclude='/packages'" PORTAGE_TMPDIR="/var/tmp" PORTDIR="/usr/portage" SYNC="rsync://rsync.gentoo.org/gentoo-portage" USE="x86 X a52 aac acpi alsa apache2 asf berkdb bitmap-fonts cairo cdr cdrom cli cracklib crypt cups dbus divx dlloader dri dts dvd dvdr dvdread eds elibc_glibc emboss encode fam ffmpeg firefox flac fortran gdbm gif gnome gpm gstreamer gtk hal iconv input_devices_keyboard input_devices_mouse ipv6 isdnlog java jpeg kde kdeenablefinal kernel_linux ldap libg++ linguas_de linguas_de_CH linguas_en linguas_en_GB mad mikmod mmx mono mp3 mpeg ncurses nls nptl nptlonly ogg opengl oss pam pcre perl png ppds pppd python qt3 qt4 quicktime readline reflection rtsp ruby samba sdl session smp spell spl sse sse2 sse3 ssl svg tcpd test tetex theora threads truetype truetype-fonts type1-fonts udev unicode userland_GNU vcd video_cards_fbdev video_cards_i810 video_cards_vesa vorbis win32codecs wxwindows x264 xine xml xorg xprint xv xvid zlib" Unset: CTARGET, INSTALL_MASK, LANG, LC_ALL, LDFLAGS, PORTAGE_RSYNC_EXTRA_OPTS, PORTDIR_OVERLAY
The older releases had some weird behavior with shared libraries that we couldn't fix (it took a lot of reworking for upstream to fix 2.3). If you want the tests to pass on 2.1/2.2, you can use this workaround: 1. emerge --unmerge openldap 2. FEATURES=-test emerge =openldap-2.1* 3. FEATURES=test emerge =openldap-2.1* All three stages are absolutely required if you want the tests to work. I fixed the ${WORKDIR}/${S} typo as well now, but it was merely cosmetic.
thanks for the tip to test the older versions, will do this next time. net-nds/openldap-2.3.27-r3 USE="berkdb crypt gdbm ipv6 perl readline samba ssl tcpd -debug -kerberos -minimal -odbc -overlays -sasl (-selinux) -slp -smbkrb5passwd" 1. emerges on x86, please note: QA Notice: pre-stripped files found: /var/tmp/portage/openldap-2.3.27-r3/image/usr/lib/liblber.so.2.0.130 /var/tmp/portage/openldap-2.3.27-r3/image/usr/lib/libldap.so.2.0.130 /var/tmp/portage/openldap-2.3.27-r3/image/usr/lib/libldap_r.so.2.0.130 2. passes collision test 3. passes test suite 4. revdep-rebuild again fixed my broken packages without problems. (I suppose this wouldn't be necessary when updating from a 2.3* version) emerge --info @ comment 11
(In reply to comment #8) > openldap-2.1.30-r8 Done on x86. Am now testing 2.2* which will take some time (because of revdep-rebuild), so if anyone of x86 projects wants to do 2.3*, feel free. Thanks Markus.
(In reply to comment #14) > (In reply to comment #8) > > openldap-2.1.30-r8 > > Done on x86. Am now testing 2.2* which will take some time (because of > revdep-rebuild), so if anyone of x86 projects wants to do 2.3*, feel free. > Thanks Markus. Ok, that was fast. openldap-2.2.28-r5 done on x86, testing 2.3 now. I leave for some hours and will do the last step later.
I tested openldap-2.3.27-r3, 2.2.28-r5 and 2.1.30-r8 on amd64, they're all emerging fine and passing their test suites (thanks for the tip in comment 12 for 2.2 and 2.1), so they're ready for prime time :) Portage 2.1.1-r2 (default-linux/amd64/2006.1/desktop, gcc-4.1.1, glibc-2.4-r4, 2.6.18-suspend2-Dudebox-Edition x86_64) ================================================================= System uname: 2.6.18-suspend2-Dudebox-Edition x86_64 AMD Athlon(tm) 64 Processor 3200+ Gentoo Base System version 1.12.6 Last Sync: Wed, 22 Nov 2006 05:00:01 +0000 distcc 2.18.3 x86_64-pc-linux-gnu (protocols 1 and 2) (default port 3632) [enabled] ccache version 2.3 [enabled] app-admin/eselect-compiler: [Not Present] dev-java/java-config: [Not Present] dev-lang/python: 2.4.3-r4 dev-python/pycrypto: 2.0.1-r5 dev-util/ccache: 2.3 dev-util/confcache: [Not Present] sys-apps/sandbox: 1.2.17 sys-devel/autoconf: 2.13, 2.60 sys-devel/automake: 1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2 sys-devel/binutils: 2.16.1-r3 sys-devel/gcc-config: 1.3.13-r4 sys-devel/libtool: 1.5.22 virtual/os-headers: 2.6.11-r2 ACCEPT_KEYWORDS="amd64" AUTOCLEAN="yes" CBUILD="x86_64-pc-linux-gnu" CFLAGS="-march=k8 -msse3 -Os -pipe" CHOST="x86_64-pc-linux-gnu" CONFIG_PROTECT="/etc /usr/kde/3.5/env /usr/kde/3.5/share/config /usr/kde/3.5/shutdown /usr/share/X11/xkb /usr/share/config /var/qmail/alias /var/qmail/control" CONFIG_PROTECT_MASK="/etc/env.d /etc/gconf /etc/revdep-rebuild /etc/terminfo /etc/texmf/web2c" CXXFLAGS="-march=k8 -msse3 -Os -pipe" DISTDIR="/usr/portage/distfiles" FEATURES="autoconfig ccache collision-protect distcc distlocks metadata-transfer multilib-strict parallel-fetch sandbox sfperms strict test" GENTOO_MIRRORS="ftp://linux.rz.ruhr-uni-bochum.de/gentoo-mirror/ ftp:///ftp-stud.fht-esslingen.de/pub/Mirrors/gentoo/" LDFLAGS="-Wl,-O1" MAKEOPTS="-j4" PKGDIR="/usr/portage/packages" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --delete-after --stats --timeout=180 --exclude='/distfiles' --exclude='/local' --exclude='/packages'" PORTAGE_TMPDIR="/var/tmp" PORTDIR="/usr/portage" PORTDIR_OVERLAY="/usr/local/portage_overlay" SYNC="rsync://server/gentoo-portage" USE="amd64 X alsa apache2 berkdb bitmap-fonts cairo cdr cli cracklib crypt cups dbus dlloader dri dvd dvdr eds elibc_glibc emboss encode esd fam firefox fortran gcj gdbm gif gpm gstreamer gtk gtk2 hal iconv imap input_devices_keyboard input_devices_mouse isdnlog jpeg kde kdeenablefinal kdehiddenvisibility kernel_linux libg++ mad mikmod mp3 mpeg mysql ncurses nls nptl nptlonly objc objc++ ogg oss pam pcre perl png ppds pppd python qt3 quicktime readline reflection sdl session spell spl sqlite ssl tcpd test truetype truetype-fonts type1-fonts udev unicode userland_GNU video_cards_radeon vorbis xml xorg xv zlib" Unset: CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LANG, LC_ALL, LINGUAS, PORTAGE_RSYNC_EXTRA_OPTS
And x86 is gone
ppc stable
sparc stable.
Stable on Alpha + ia64.
ranger marked stable (comment #10). I have seen this failure in make tests, too. I don't think this will get resolved in those older branches. removing us from CC.
amd64 is fine
This one is ready for GLSA decision. I tend to vote YES.
YES.
Reverting to full YES. Let's have a GLSA.
HPPA done.
Finally on -announce GLSA 200611-25
epsilon ~ # glsa-check -f 200611-25 fixing 200611-25 >>> merging net-nds/openldap-2.3.27-r3 Calculating dependencies... done! >>> Emerging (1 of 1) net-nds/openldap-2.3.27-r3 to / * openldap-2.3.27.tgz MD5 ;-) ... [ ok ] * openldap-2.3.27.tgz RMD160 ;-) ... [ ok ] * openldap-2.3.27.tgz SHA1 ;-) ... [ ok ] * openldap-2.3.27.tgz SHA256 ;-) ... [ ok ] * openldap-2.3.27.tgz size ;-) ... [ ok ] * checking ebuild checksums ;-) ... [ ok ] * checking auxfile checksums ;-) ... [ ok ] * checking miscfile checksums ;-) ... [ ok ] * checking openldap-2.3.27.tgz ;-) ... [ ok ] * * Scanning datadir(s) from slapd.conf and * the default installdir for Versiontags * (/var/lib/openldap-data may appear twice) * * - Checking /var/lib/openldap-data... * Found Versiontag in /var/lib/openldap-data * Versiontag is fine here :) * * - Checking /var/lib/openldap-data... * Found Versiontag in /var/lib/openldap-data * Versiontag is fine here :) * * * All datadirs are fine, proceeding with merge now... * >>> Unpacking source... >>> Unpacking openldap-2.3.27.tgz to /var/tmp/portage/openldap-2.3.27-r3/work * Applying openldap-2.2.14-perlthreadsfix.patch ... [ ok ] * Applying openldap-2.2.6-ntlm.patch ... [ ok ] * Cannot find $EPATCH_SOURCE! Value for $EPATCH_SOURCE is: * * /usr/portage/net-nds/openldap/files/openldap-2.3.27-CVE-2006-5779.patch * ( openldap-2.3.27-CVE-2006-5779.patch ) !!! ERROR: net-nds/openldap-2.3.27-r3 failed. Call stack: ebuild.sh, line 1546: Called dyn_unpack ebuild.sh, line 708: Called src_unpack openldap-2.3.27-r3.ebuild, line 205: Called epatch '/usr/portage/net-nds/openldap/files/openldap-2.3.27-CVE-2006-5779.patch' eutils.eclass, line 198: Called die !!! Cannot find $EPATCH_SOURCE! !!! If you need support, post the topmost build error, and the call stack if relevant.
please rsync again and file a new bug if the problem is still here.
