Date: Tue, 12 Dec 2006 01:42:47 -0800
From: Solar Eclipse <solareclipse@phreedom.org.>
To: [email protected]Subject: OpenLDAP kbind authentication buffer overflow
Message-ID: <20061212094247.GA6126@dsl093-068-003.sfo1.dsl.speakeasy.net.>
Mail-Followup-To: Solar Eclipse <solareclipse@phreedom.org.>,
[email protected], [email protected]
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.4.2.1i
X-Virus-Scanned: antivirus-gw at tyumen.ru
There is a remotely exploitable buffer overflow in the Kerberos KBIND
authentication code in the OpenLDAP slapd server.
The vulnerability is in the krbv4_ldap_auth function in
servers/slapd/kerberos.c. This function processes LDAP bind requests that
specify the LDAP_AUTH_KRBV41 authentication method. The cred variable contains
a pointer to the Kerberos authentication data sent by the client. The length of
the data is not checked before it is copied into a fixed size buffer on the
stack. Sending a bind request with more than 1250 bytes of credential data will
result in a buffer overflow. The vulnerable code is given below:
krbv4_ldap_auth(Backend *be, struct berval *cred, AUTH_DAT *ad)
{
KTEXT_ST k;
KTEXT ktxt = &k;
char instance[INST_SZ];
int err;
Debug( LDAP_DEBUG_TRACE, "=> kerberosv4_ldap_auth\n", 0, 0, 0 );
AC_MEMCPY( ktxt->dat, cred->bv_val, cred->bv_len );
There should be a length check before the call to memcpy.
The vulnerable code is enabled only when OpenLDAP is compiled with the
--enable-kbind option, which has been disabled by default since version 2.0.2
and was removed from the configure script in the 2.1 release. The chance of
finding a real system that is still vulnerable is minimal, however the code is
still available in the latest 2.4.3 version of OpenLDAP and can be enabled
manually as described in http://www.openldap.org/lists/openldap-software/200206/msg00371.html
For more details and exploit code see
http://www.phreedom.org/solar/exploits/openldap-kbind/
Solar Eclipse
