OpenLDAP LDAP denial of service found using PROTOS LDAPv3 test suite
| openldap-ldap-protos-dos (6904) |  Medium Risk |
Description:
The Lightweight Directory Access Protocol (LDAP) implementation in OpenLDAP is vulnerable to a denial of service attack, caused by a vulnerability in the code that translates network datagrams into application-specific information. A remote attacker can crash the LDAP service on the server. This vulnerability was discovered with the PROTOS LDAPv3 test suite.
Consequences:
Denial of Service
Remedy:
For LDAPv2:
Upgrade to the latest version of OpenLDAP (1.2.12 or later), as listed in CERT Advisory CA-2001-18. See References.
For LDAPv3:
Upgrade to the latest version of OpenLDAP (2.0.8 or later), as listed in CERT Advisory CA-2001-18. See References.
For Red Hat Linux 6.2:
Upgrade to the latest version of OpenLDAP (1.2.12-3 or later), as listed in RHSA-2001:098-05. See References.
For Red Hat Linux 7.0 and 7.1:
Upgrade to the latest version of OpenLDAP (2.0.11-8 or later), as listed in RHSA-2001:098-05. See References.
For Debian GNU/Linux 2.2 (potato):
Upgrade to the latest version of OpenLDAP (1.2.12-1 or later), as listed in DSA-068-1. See References.
For Mandrake Linux 7.1 and Corporate Server 1.0.1:
Upgrade to the latest version of OpenLDAP (1.2.12-1.3mdk or later), as listed in MandrakeSoft Security Advisory MDKSA-2001:069 : openldap. See References.
For Mandrake Linux 7.2 and Single Network Firewall 7.2:
Upgrade to the latest version of OpenLDAP (1.2.12-1.2mdk or later), as listed in MandrakeSoft Security Advisory MDKSA-2001:069 : openldap. See References.
For Mandrake Linux 8.0:
Upgrade to the latest version of OpenLDAP and libLDAP, as listed in MandrakeSoft Security Advisory MDKSA-2001:069 : openldap. See References.
For Conectiva Linux 4.1:
Upgrade to the latest version of OpenLDAP (1.2.12-1U41_1cl or later), as listed in Conectiva Linux Announcement CLSA-2001:417. See References.
For Conectiva Linux 4.2:
Upgrade to the latest version of OpenLDAP (1.2.12-1U42_1cl or later), as listed in Conectiva Linux Announcement CLSA-2001:417. See References.
For Conectiva Linux 5.0, prg graficos, and ecommerce:
Upgrade to the latest version of OpenLDAP (1.2.12-1U50_1cl or later), as listed in Conectiva Linux Announcement CLSA-2001:417. See References.
For Conectiva Linux 5.1:
Upgrade to the latest version of OpenLDAP (1.2.12-1U51_1cl or later), as listed in Conectiva Linux Announcement CLSA-2001:417. See References.
For Conectiva Linux 6.0:
Upgrade to the latest version of OpenLDAP (1.2.12-1U60_1cl or later), as listed in Conectiva Linux Announcement CLSA-2001:417. See References.
For Conectiva Linux 7.0:
Upgrade to the latest version of OpenLDAP (1.2.12-1U70_1cl or later), as listed in Conectiva Linux Announcement CLSA-2001:417. See References.
For other distributions:
Contact your vendor for patch or upgrade information.
References:
- CERT Advisory CA-2001-18: Multiple Vulnerabilities in Several Implementations of the Lightweight Directory Access Protocol (LDAP).
- CIAC Information Bulletin L-116: Lightweight Directory Access Protocol (LDAP) Vulnerabilities.
- Conectiva Linux Announcement CLSA-2001:417: Remote DoS vulnerability in openldap.
- BID-3049: OpenLDAP Denial of Service Vulnerabilities
- CVE-2001-0977: slapd in OpenLDAP 1.x before 1.2.12, and 2.x before 2.0.8, allows remote attackers to cause a denial of service (crash) via an invalid Basic Encoding Rules (BER) length field.
- DSA-068: openldap -- remote DoS
- MDKSA-2001:069: Updated openldap packages fix invalid packet handling vulnerability
- OSVDB ID: 1905: OpenLDAP slapd Invalid BER Length Field DoS
- RHSA-2001-098: Updated OpenLDAP packages available for Red Hat Linux 6.2
- US-CERT VU#935800: Multiple versions of OpenLDAP are vulnerable to denial-of-service attacks
Platforms Affected:
- Conectiva Linux 4.1
- Conectiva Linux 4.2
- Conectiva Linux 5.0
- Conectiva Linux 5.1
- Conectiva Linux 6.0
- Conectiva Linux 7.0
- Conectiva Linux ecommerce
- Conectiva Linux prg_graficos
- Debian Debian Linux 2.2
- MandrakeSoft Mandrake Linux 7.1
- MandrakeSoft Mandrake Linux 7.2
- MandrakeSoft Mandrake Linux 8.0
- MandrakeSoft Mandrake Linux Corporate Server 1.0.1
- MandrakeSoft Mandrake Single Network Firewall 7.2
- OpenLDAP OpenLDAP
- RedHat Linux 6.2
- RedHat Linux 7
- RedHat Linux 7.1
- RedHat Linux 7.2
- RedHat Linux 7.3
Reported:
Jul 16, 2001
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net