Bug 751945 (CVE-2012-1164) - VUL-1: CVE-2012-1164: openldap: slapd search query DoS
Summary: VUL-1: CVE-2012-1164: openldap: slapd search query DoS
Status: RESOLVED FIXED
Alias: CVE-2012-1164
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P4 - Low : Normal
Target Milestone: ---
Assignee: Ralf Haferkamp
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/40466/
Whiteboard: maint:released:sle11-sp1:46562 maint:...
Keywords:
Depends on:
Blocks:
 
Reported: 2012-03-13 07:57 UTC by Ludwig Nussel
Modified: 2020-05-12 17:35 UTC (History)
1 user (show)

See Also:
Found By: Other
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Ludwig Nussel 2012-03-13 07:57:16 UTC
Your friendly security team received the following report via oss-security.
Please respond ASAP.
The issue is public.

CVE-2012-1164
------------------------------------------------------------------------------
Date: Mon, 12 Mar 2012 18:36:17 +0100
From: Jan Lieskovsky <jlieskov@redhat.com>
Subject: [oss-security] CVE Request -- openldap (slapd): Assertion failure by processing
 search queries requesting only attributes for particular entry

Hello Kurt, Steve, vendors,

   a denial of service flaw was found in the way the slapd server of the OpenLDAP,
the Lightweight Directory Access Protocol applications and development suite,
processed certain search queries requesting only attributes (no values) for a
particular entry. A remote attacker could issue a specially-crafted LDAP search
query, which once processed by a vulnerable slapd server would lead to
assertion failure (slapd abort).

Upstream bug report:
[1] http://www.openldap.org/its/index.cgi/Software%20Bugs?id=7143

Original upstream patch:
[2] 
http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=commit;h=ef2f5263de8802794e528cc2648ecfca369302ae

Further patches:
[3] 
http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=commit;h=430256fafb85028443d7964a5ab1f4bbf8b2db38

[4] 
http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=commit;h=463c1fa25d45e393dc1f1ea235286f79e872fad0

References:
[5] http://www.openldap.org/software/release/changes.html
[6] https://bugs.gentoo.org/show_bug.cgi?id=407941
[7] https://secunia.com/advisories/48372/
[8] https://bugzilla.redhat.com/show_bug.cgi?id=802514

Could you allocate a CVE identifier for this?

Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team
Comment 1 Swamp Workflow Management 2012-03-13 23:00:08 UTC
bugbot adjusting priority
Comment 2 Ludwig Nussel 2012-03-16 13:22:20 UTC
seems to require a special config, rating low, planned update
Comment 3 Ralf Haferkamp 2012-04-03 07:31:12 UTC
For SLES-11 (SP1/SP2) we can include this fix into the update for bug#750466, The SWAMP ID is 45911.
Is it required to create a new SWAMP ID for that, or can you just update the existing one?
Comment 4 Ludwig Nussel 2012-04-03 08:30:58 UTC
low severity so it's fine and desirable to include the fix in higher rated maintenance updates
Comment 5 Ralf Haferkamp 2012-04-03 09:22:01 UTC
Fix submitted for SLES-11-SP1, SR#18422 (other Products will be handle through the "planned updates" queue) . Patchinfo updated (SWAMP#45911).
Comment 6 Swamp Workflow Management 2012-06-14 17:18:57 UTC
Update released for: compat-libldap-2_3-0, libldap-2_4-2, libldap-2_4-2-32bit, libldap-2_4-2-x86, openldap2, openldap2-back-meta, openldap2-back-perl, openldap2-client, openldap2-client-debuginfo, openldap2-client-debugsource, openldap2-debuginfo, openldap2-debugsource, openldap2-devel, openldap2-devel-32bit
Products:
SLE-DEBUGINFO 11-SP1 (i386, ia64, ppc64, s390x, x86_64)
SLE-DESKTOP 11-SP1 (i386, x86_64)
SLE-DESKTOP 11-SP1-FOR-SP2 (i386, x86_64)
SLE-SDK 11-SP1 (i386, ia64, ppc64, s390x, x86_64)
SLE-SDK 11-SP1-FOR-SP2 (i386, ia64, ppc64, s390x, x86_64)
SLE-SERVER 11-SP1 (i386, ia64, ppc64, s390x, x86_64)
SLE-SERVER 11-SP1-FOR-SP2 (i386, ia64, ppc64, s390x, x86_64)
SLE-SERVER 11-SP1-TERADATA (x86_64)
SLES4VMWARE 11-SP1 (i386, x86_64)