tbordaz [Mon, 21 Mar 2022 13:24:12 +0000 (14:24 +0100)]
CVE-2021-4091 - double-free of the virtual attribute context in persistent search (#5219) - Issue 5218
description:
A search is processed by a worker using a private pblock.
If the search is persistent, the worker spawn a thread
and kind of duplicate its private pblock so that the spawn
thread continue to process the persistent search.
Then worker ends the initial search, reinit (free) its private pblock,
and returns monitoring the wait_queue.
When the persistent search completes, it frees the duplicated
pblock.
The problem is that private pblock and duplicated pblock
are referring to a same structure (pb_vattr_context).
That can lead to a double free
Fix:
When cloning the pblock (slapi_pblock_clone) make sure
to transfert the references inside the original (private)
pblock to the target (cloned) one
That includes pb_vattr_context pointer.
Reviewed by: Mark Reynolds, James Chapman, Pierre Rogier (Thanks !)
CVE-2021-3652 - locked crypt accounts on import may allow all passwords (#4819) - Issue 4817 - BUG
Bug Description: Due to mishanding of short dbpwd hashes, the
crypt_r algorithm was misused and was only comparing salts
in some cases, rather than checking the actual content
of the password.
Fix Description: Stricter checks on dbpwd lengths to ensure
that content passed to crypt_r has at least 2 salt bytes and
1 hash byte, as well as stricter checks on ct_memcmp to ensure
that compared values are the same length, rather than potentially
allowing overruns/short comparisons.
Pierre Rogier [Fri, 14 Jun 2024 11:27:10 +0000 (13:27 +0200)]
Security fix for CVE-2024-5953
Description:
A denial of service vulnerability was found in the 389 Directory Server.
This issue may allow an authenticated user to cause a server denial
of service while attempting to log in with a user with a malformed hash
in their password.
Fix Description:
To prevent buffer overflow when a bind request is processed, the bind fails
if the hash size is not coherent without even attempting to process further
the hashed password.
Pierre Rogier [Wed, 17 Apr 2024 16:18:04 +0000 (18:18 +0200)]
Security fix for CVE-2024-3657
Description:
A flaw was found in the 389 Directory Server. A specially-crafted LDAP query
can potentially cause a failure on the directory server, leading to a denial
of service.
Fix Description:
The code was modified to avoid a buffer overflow when logging some requests
in the audit log.
James Chapman [Wed, 1 May 2024 14:01:33 +0000 (15:01 +0100)]
Security fix for CVE-2024-2199
Description:
A denial of service vulnerability was found in the 389 Directory Server.
This issue may allow an authenticated user to cause a server crash while
modifying userPassword using malformed input.
Fix Description:
When doing a mod on userPassword we reset the pblock modifier after we
set the modified timestamp, ensuring the pblock data stays valid.
Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
Bug description:
SLAPI_OPERATION_TYPE is a stored/read as an int (slapi_pblock_get/set).
This although the storage field is an unsigned long.
Calling slapi_pblock_get with an long (8 btyes) destination creates
a problem on big-endian (s390x).
Fix description:
Define destination op_type as an int (4 bytes)
Bug Description: Slapi_ct_memcmp expects both inputs to be
at LEAST size n. If they are not, we only compared UP to n.
Invalid migrations of passwords (IE {CRYPT}XX) would create
a pw which is just salt and no hash. ct_memcmp would then
only verify the salt bits and would allow the authentication.
This relies on an administrative mistake both of allowing
password migration (nsslapd-allow-hashed-passwords) and then
subsequently migrating an INVALID password to the server.
Fix Description: slapi_ct_memcmp now access n1, n2 size
and will FAIL if they are not the same, but will still compare
n bytes, where n is the "longest" memory, to the first byte
of the other to prevent length disclosure of the shorter
value (generally the mis-migrated password)
* Non-maintainer upload by the LTS team.
* Backport security patches from the upstream.
- CVE-2021-3652: Locked crypt accounts on import may allow any password.
- CVE-2021-4091: Double-free of the virtual attribute context in
persistent search, forcing the server to behave unexpectedly, and crash.
- CVE-2022-0918: Denial of service triggered by specially crafted
unauthenticated message crashing the server.
- CVE-2022-0996: User with an expired password can still login with full
privileges.
- CVE-2022-2850: Crash while managing invalid cookie causing denial of
service.
- CVE-2024-2199 and CVE-2024-8445: Crash when modifying userPassword using
malformed input.
- CVE-2024-3657: Failure on the directory server with specially crafted
LDAP query leading to denial of service.
- CVE-2024-5953: Denial of service while attempting to log in with
a user with a malformed hash in their password.
projects / 389-ds-base.git / log