Vulnerability Note VU#652196

Apple Mac OS X Open Directory server vulnerable to DoS via an invalid LDAP request

Overview

Apple has reported a vulnerability in their version of OpenLDAP that is included in Apple Mac OS X and Mac OS X Server versions 10.4 to 10.4.6. If successfully exploited, this vulnerability would allow an attacker to create a denial-of-service condition.

I. Description

OpenLDAP is a popular open-source implementation of the Lightweight Directory Access Protocol (LDAP). The software allows LDAP-aware programs on a network to get information from a server. Apple uses OpenLDAP as a part of their Open Directory product.

Apple reports that there is an assertion error in their implementation of OpenLDAP. An attacker may be able to exploit this vulnerability by sending a specially crafted invalid LDAP request to the server which triggers the assertion. The result of a successful attack would be a denial-of-service condition.

Only network access to the server is required to exploit this vulnerability.

II. Impact

A remote unauthenticated attacker may be able to create a denial-of-service condition.

III. Solution

Upgrade

Apply the upgrade provided by Apple. Refer to the Apple security updates in Mac OS X version 10.4.7 for more information.

Restrict Access

Restrict access to servers running affected versions of the software to trusted hosts or networks. Apple lists the LDAP ports used by their products as 389/tcp and 389/udp.

Systems Affected

Vendor	Status	Date Notified	Date Updated
Apple Computer, Inc.	Vulnerable	28-Jun-2006

References

http://lists.apple.com/archives/security-announce/2006/Jun/msg00000.html
http://www.apple.com/server/macosx/features/opendirectory.html
http://docs.info.apple.com/article.html?artnum=106439

Credit

Thanks to Apple Product Security for reporting this vulnerability. Apple, in turn, credits the Mu Security research team with reporting this issue to them.

This document was written by Ryan Giobbi.

Other Information

Date Public:	2006-06-27
Date First Published:	2006-06-28
Date Last Updated:	2006-06-29
CERT Advisory:
CVE-ID(s):	CVE-2006-1470
NVD-ID(s):	CVE-2006-1470
US-CERT Technical Alerts:
Metric:	0.22
Document Revision:	22

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Produced 2006 by US-CERT, a government organization
Disclaimers and copyright information Get a PDF Reader