REDHAT-BUG-1019490: Medium severity red hat openldap servers vulnerability
It was discovered that OpenLDAP, with the rwm overlay to slapd, could segfault if a user were able to query the directory and immediately unbind from the server. This seems to be due to the rwm overlay not doing reference counting properly, so rwmconndestroy frees the session context while rwmopsearch is using it. This condition also seems to require multiple cores/CPUs to trigger.
This was also reported upstream [1] and is currently unfixed.
[1] http://www.openldap.org/its/index.cgi/Incoming?id=7723
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1019490?
The severity of REDHAT-BUG-1019490 is considered moderate due to the potential for denial of service through a segmentation fault.
How do I fix REDHAT-BUG-1019490?
Fixing REDHAT-BUG-1019490 involves updating OpenLDAP to the latest patched version that addresses the reference counting issue.
Which versions of OpenLDAP are affected by REDHAT-BUG-1019490?
REDHAT-BUG-1019490 affects versions of OpenLDAP that implement the rwm overlay to slapd.
What causes the issue in REDHAT-BUG-1019490?
The issue in REDHAT-BUG-1019490 is caused by improper reference counting in the rwm overlay, leading to a segmentation fault when a client unbinds immediately after querying.
Can REDHAT-BUG-1019490 be exploited remotely?
Yes, REDHAT-BUG-1019490 can potentially be exploited remotely if an attacker can query the OpenLDAP server and then unbind quickly.