OpenLDAP slurpd command line buffer overflow
| openldap-slurpd-bo (10800) |  High Risk |
Description:
OpenLDAP is vulnerable to a buffer overflow in the slurpd daemon, which provides replication services for OpenLDAP. By passing an overly long -t or -r command line argument to slurpd or by creating an overly long advisory lock, a local or remote attacker could overflow a buffer and execute arbitrary code on the system with privileges of the OpenLDAP process.
Consequences:
Gain Access
Remedy:
For SuSE Linux:
Upgrade to the latest openldap2 package, as listed below. Refer to SuSE Security Announcement SuSE-SA:2002:047 for more information. See References.
SuSE Linux 8.0 (Intel): 2.0.23-143 or later
SuSE Linux 7.3 (Intel): 2.0.12-44 or later
SuSE Linux 7.3 (Sparc): 2.0.12-27 or later
SuSE Linux 7.3 (PPC): 2.0.12-54 or later
SuSE Linux 7.2 (Intel): 2.0.11-67 or later
SuSE Linux 7.1 (Intel): 2.0.11-66 or later
SuSE Linux 7.1 (AXP): 2.0.11-30 or later
SuSE Linux 7.1 (PPC): 2.0.11-27 or later
For Conectiva Linux:
Upgrade to the latest openldap package, as listed below. Refer to Conectiva Linux Announcement CLSA-2002:556 for more information. See References.
Conectiva Linux 6.0: 2.0.21-1U60_2cl or later
Conectiva Linux 7.0: 2.0.25-1U70_3cl or later
Conectiva Linux 8.0: 2.0.25-1U80_3cl or later
For Gentoo Linux:
Upgrade versions net-nds/openldap-2.0.25-r2 and earlier, as listed in Gentoo Linux Security Announcement 200212-12. See References.
For Debian GNU/Linux:
Upgrade to the latest openldap2 package, as listed below. Refer to DSA-227-1 for more information. See References.
Debian GNU/Linux 3.0 (woody): 2.0.23-6.3 or later
For Mandrake Linux:
Upgrade to the latest openldap package, as listed below. Refer to MandrakeSoft Security Advisory MDKSA-2003:006:openldap for more information. See References.
Mandrake Linux 8.0 and 8.1 : 2.0.21-2.1mdk or later
Mandrake Linux 8.2 and Multi Network Firewall 8.2: 2.0.21-4.1mdk or later
Mandrake Linux 9.0: 2.0.25-7.1mdk or later
For Red Hat Linux:
Upgrade to the latest openldap package, as listed below. Refer to RHSA-2003:040-07 for more information. See References.
Red Hat 6.2: 1.2.13-2 or later
Red Hat 7.0 and 7.1: 2.0.27-2.7.1 or later
Red Hat 7.2 and 7.3: 2.0.27-2.7.3 or later
Red Hat 8.0: 2.0.27-2.8.0 or later
For Red Hat Linux containing the openldap package:
Upgrade to the latest openldap package, as listed below. Refer to RHSA-2003:312-12 for more information. See References.
Red Hat Enterprise Linux AS (v. 2.1) and Red Hat Linux Advanced Workstation 2.1 for the Itanium Processor: 2.0.27-2.7.3 or later
For SGI IRIX:
Apply the patch for this vulnerability, as listed in SGI Security Advisory 20031002-01-U. See References.
For other distributions:
Contact your vendor for upgrade or patch information.
References:
- CIAC Information Bulletin N-043: Red Hat openldap Vulnerabilities.
- Conectiva Linux Announcement CLSA-2002:556: openldap.
- Gentoo Linux Security Announcement 200212-12: openldap -- remote command execution.
- SGI Security Advisory 20031002-01-U: SGI Advanced Linux Environment security update #3.
- BID-6328: OpenLDAP Multiple Buffer Overflow Vulnerabilities
- CVE-2002-1378: Multiple buffer overflows in OpenLDAP2 (OpenLDAP 2) 2.2.0 and earlier allow remote attackers to execute arbitrary code via (1) long -t or -r parameters to slurpd, (2) a malicious ldapfilter.conf file that is not properly handled by getfilter functions, (3) a malicious ldaptemplates.conf that causes an overflow in libldap, (4) a certain access control list that causes an overflow in slapd, or (5) a long generated filename for logging rejected replication requests.
- DSA-227: openldap2 -- buffer overflows and other bugs
- MDKSA-2003:006: Updated OpenLDAP packages fix multiple vulnerabilities
- RHSA-2002-312: openldap security update
- RHSA-2003-040: Updated openldap packages available
- RHSA-2003-208: Updated openldap packages available for iSeries and pSeries
- SUSE-SA:2002:047: OpenLDAP2: remote command execution
Platforms Affected:
- Conectiva Linux 6.0
- Conectiva Linux 7.0
- Conectiva Linux 8.0
- Debian Debian Linux 3.0
- Gentoo Linux
- MandrakeSoft Mandrake Linux 8.0
- MandrakeSoft Mandrake Linux 8.0 PPC
- MandrakeSoft Mandrake Linux 8.1
- MandrakeSoft Mandrake Linux 8.1 IA64
- MandrakeSoft Mandrake Linux 8.2 PPC
- MandrakeSoft Mandrake Linux 8.2
- MandrakeSoft Mandrake Linux 9.0
- MandrakeSoft Mandrake Multi Network Firewall 8.2
- Novell SuSE Linux Enterprise Server 7.0
- OpenLDAP OpenLDAP 2.2.0 and prior
- RedHat Enterprise Linux 2.1 AW
- RedHat Enterprise Linux 2.1 AS
- RedHat Linux 6.2
- RedHat Linux 7
- RedHat Linux 7.1
- RedHat Linux 7.1 for iSeries
- RedHat Linux 7.1 for pSeries
- RedHat Linux 7.2
- RedHat Linux 7.3
- RedHat Linux 8.0
- RedHat Linux Advanced Workstation 2.1 Itanium
- SGI IRIX 2.2.1
- SGI IRIX 2.3
- SuSE SuSE eMail Server 3.1
- SuSE SuSE eMail Server III
- SUSE SuSE Linux 7.1
- SUSE SuSE Linux 7.2
- SUSE SuSE Linux 7.3
- SUSE SuSE Linux 8.0
- SuSE SuSE Linux Connectivity Server
- SuSE SuSE Linux Office Server
- Turbolinux Turbolinux 7 Server
- Turbolinux Turbolinux 7 Workstation
- Turbolinux Turbolinux 8 Server
- Turbolinux Turbolinux 8 Workstation
- Turbolinux Turbolinux Advanced Server 6
- Turbolinux Turbolinux Server 6.1
- Turbolinux Turbolinux Server 6.5
Reported:
Dec 06, 2002
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net