Vulnerability Note VU#258905

Multiple implementations of LDAP Directory Server vulnerable to buffer overflow

Overview

A buffer overflow in some implementations of the LDAP protocol may allow a remote unauthenticated attacker to execute arbitrary code.

I. Description

The Lightweight Directory Access Protocol (LDAP) is a protocol for accessing network based directories. A lack of bounds checking in some implementations of the LDAP protocol may allow a buffer used to generate error messages to overflow. If a remote unauthenticated attacker supplies a LDAP server with a specially crafted request, they may be able to trigger the buffer overflow to compromise the vulnerable server.

II. Impact

A remote unauthenticated attacker may be able to execute arbitrary code on a vulnerable LDAP server with the privileges of the compromised LDAP process, or crash the LDAP process resulting in a denial-of-service condition.

III. Solution

Users who suspect they are vulnerable are encouraged to check with their vendor to determine the appropriate action to take.

Limit Access

Block or restrict access to the LDAP service (389/tcp or 636/tcp) on affected systems from untrusted networks such as the Internet. Sites, particularly those who are not able to apply the appropriate patches, are encouraged to consider implementing this workaround. Note that this change may break some desired functionality depending on particular site configuration details. As a general rule and a matter of good security practice, the CERT/CC recommends blocking access to all services that are not explicitly required.

Systems Affected

Vendor	Status	Date Notified
Apple Computer Inc.	Not Vulnerable	14-Jan-2005
Conectiva	Unknown	15-Dec-2004
Cray Inc.	Unknown	15-Dec-2004
Cybozu	Not Vulnerable	13-Jan-2005
Debian	Unknown	15-Dec-2004
EMC Corporation	Unknown	15-Dec-2004
Engarde	Unknown	15-Dec-2004
F5 Networks	Unknown	15-Dec-2004
FreeBSD	Unknown	16-Dec-2004
Fujitsu	Unknown	13-Jan-2005
Hewlett-Packard Company	Vulnerable	11-Jan-2005
Hitachi	Vulnerable	13-Jan-2005
IBM	Unknown	15-Dec-2004
Immunix	Unknown	15-Dec-2004
Ingrian Networks	Unknown	15-Dec-2004
Juniper Networks	Not Vulnerable	11-Jan-2005
Lotus Software	Not Vulnerable	16-Dec-2004
MandrakeSoft	Unknown	15-Dec-2004
Microsoft Corporation	Unknown	5-Jan-2005
MontaVista Software	Unknown	15-Dec-2004
NEC Corporation	Not Vulnerable	13-Jan-2005
NETBSD	Unknown	16-Dec-2004
Netscape Communications Corporation	Vulnerable	11-Jan-2005
Nokia	Unknown	16-Dec-2004
Nortel Networks	Unknown	15-Dec-2004
Novell	Unknown	15-Dec-2004
OpenLDAP	Not Vulnerable	11-Jan-2005
Openwall GNU/*/Linux	Unknown	15-Dec-2004
Oracle Corporation	Unknown	15-Dec-2004
PADL Software	Unknown	17-Dec-2004
QUALCOMM	Unknown	17-Dec-2004
Quality	Not Vulnerable	13-Jan-2005
Red Hat Inc.	Vulnerable	10-Jan-2005
SCO	Unknown	15-Dec-2004
SGI	Unknown	15-Dec-2004
Sony Corporation	Unknown	15-Dec-2004
SuSE Inc.	Not Vulnerable	11-Jan-2005
Teamware	Unknown	17-Dec-2004
Trend Micro	Unknown	13-Jan-2005
Unisys	Unknown	15-Dec-2004
Wind River Systems Inc.	Unknown	15-Dec-2004

References

http://www.ietf.org/rfc/rfc2251.txt
http://cve.mitre.org/cgi-bin/cvename.cgi?name=2004-1236
Additional information is available in Japanese at:
http://jvn.jp/jp/JVN%231BF8D7AA.html

Credit

Thanks to HIRT (Hitachi Incident Response Team).

This document was written by Damon Morda, Stacey Stewart and Jeffrey Gennari.

Other Information

Date Public:	2005-01-11
Date First Published:	2005-01-11
Date Last Updated:	2005-01-14
CERT Advisory:
CVE-ID(s):	CAN-2004-1236
NVD-ID(s):	CAN-2004-1236
US-CERT Technical Alerts:
Metric:	7.87
Document Revision:	48

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader