OpenLDAP. Multiple issues were addressed by updating to OpenLDAP version 2.4.28.
It was discovered that OpenLDAP, with the rwm overlay to slapd, could segfault if a user were able to query the directory and immediately unbind from the server. This seems to be due to the rwm overlay not doing reference counting properly, so rwmconndestroy frees the session context while rwmopsearch is using it. This condition also seems to require multiple cores/CPUs to trigger.
This was also reported upstream [1] and is currently unfixed.
[1] http://www.openldap.org/its/index.cgi/Incoming?id=7723
OpenLDAP. Multiple issues were addressed by updating to OpenLDAP version 2.4.28.
A bug in slapd's UTF8StringNormalize() function can cause a one-byte buffer overflow when it is passed a zero-length string. The code then writes a '\0' past the one-byte long buffer allocated on the heap, which could possibly allow a remote authenticated user to crash slapd. As per the upstream report [1], this bug has been present since 2003-04-07 [2] so should affect all versions of openldap we currently ship.
A patch to correct the flaw has been committed [3] (depends on the previous patch [4]).
[1] http://www.openldap.org/its/index.cgi/Software%20Bugs?id=7059;selectid=7059 [2] http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=commitdiff;h=67d6b23d [3] http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=commitdiff;h=507238713b71208ec4f262f312cb495a302df9e9 [4] http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=commitdiff;h=d0dd8616f1c68a868afeb8c2c5c09969e366e2c0
It was reported [1],[2] that OpenLDAP's slapd daemon would crash when it received a request to modify a DN and submits an empty old DN in the request. No binding is necessary, so even an anonymous user could cause slapd to crash.
This was reported against OpenLDAP 2.4.23 and was fixed in 2.4.24 [3].
References:
[1] http://www.openldap.org/its/index.cgi/Software%20Bugs?id=6768 [2] https://bugzilla.novell.com/showbug.cgi?id=674985#c1 [3] http://www.openldap.org/devel/cvsweb.cgi/servers/slapd/modrdn.c.diff?r1=1.170.2.8&r2=1.170.2.9
bind.cpp in back-ndb in OpenLDAP 2.4.x before 2.4.24 does not require authentication for the root Distinguished Name (DN), which allows remote attackers to bypass intended access restrictions via an arbitrary password.
chain.c in back-ldap in OpenLDAP 2.4.x before 2.4.24, when a master-slave configuration with a chain overlay and ppolicyforwardupdates (aka authentication-failure forwarding) is used, allows remote authenticated users to bypass external-program authentication by sending an invalid password to a slave server.