A bug in slapd's UTF8StringNormalize() function can cause a one-byte buffer overflow when it is passed a zero-length string. The code then writes a '\0' past the one-byte long buffer allocated on the heap, which could possibly allow a remote authenticated user to crash slapd. As per the upstream report [1], this bug has been present since 2003-04-07 [2] so should affect all versions of openldap we currently ship.

A patch to correct the flaw has been committed [3] (depends on the previous patch [4]).

[1] http://www.openldap.org/its/index.cgi/Software%20Bugs?id=7059;selectid=7059 [2] http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=commitdiff;h=67d6b23d [3] http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=commitdiff;h=507238713b71208ec4f262f312cb495a302df9e9 [4] http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=commitdiff;h=d0dd8616f1c68a868afeb8c2c5c09969e366e2c0

OpenLDAP. Multiple issues were addressed by updating to OpenLDAP version 2.4.28.

It was discovered that OpenLDAP, with the rwm overlay to slapd, could segfault if a user were able to query the directory and immediately unbind from the server. This seems to be due to the rwm overlay not doing reference counting properly, so rwmconndestroy frees the session context while rwmopsearch is using it. This condition also seems to require multiple cores/CPUs to trigger.

This was also reported upstream [1] and is currently unfixed.

[1] http://www.openldap.org/its/index.cgi/Incoming?id=7723

OpenLDAP. Multiple issues were addressed by updating to OpenLDAP version 2.4.28.