发布日期：2008-06-30
更新日期：2008-07-01

受影响系统：

OpenLDAP OpenLDAP 2.3.41

描述：

---

BUGTRAQ  ID: 30013
CVE(CAN) ID: CVE-2008-2952

OpenLDAP是一款开放源代码的轻量级目录访问协议（LDAP）实现。

OpenLDAP的libraries/liblber/io.c文件中的ber_get_next()函数没有正确地解码ASN.1 BER网络数据报，如果数据报的单元（标签 + 长度 + 内容）包含有

* 4字节长的多字节标签
* 4字节长的多字节大小

则解码后的整个大小为BerElement结构缓冲区加1个字节，这导致函数返回说明仍需更多数据，但读指针仍指向缓冲区末尾，这是不允许的。之后的函数调用会出现失败：

assert( 0 ); /* ber structure is messed up ?*/

<*来源：Cameron Hotchkies
  
  链接：http://www.openldap.org/its/index.cgi/Software%20Bugs?id=5580
        http://secunia.com/advisories/30853/
        https://www.redhat.com/support/errata/RHSA-2008-0583.html
        http://security.gentoo.org/glsa/glsa-200808-09.xml
        http://www.debian.org/security/2008/dsa-1650
*>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

> slapd -h ldap:// -d511 &
  ...
  > xxd packet
  0000000: ffff ff00 8441 4243 44                   .....ABCD
  > nc localhost 389 < packet

建议：

---

厂商补丁：

Debian
------
Debian已经为此发布了一个安全公告（DSA-1650-1）以及相应补丁:
DSA-1650-1：New openldap2.3 packags fix denial of service
链接：http://www.debian.org/security/2008/dsa-1650

补丁下载：
Source archives:

http://security.debian.org/pool/updates/main/o/openldap2.3/openldap2.3_2.3.30.orig.tar.gz
Size/MD5 checksum:  2971126 c40bcc23fa65908b8d7a86a4a6061251
http://security.debian.org/pool/updates/main/o/openldap2.3/openldap2.3_2.3.30-5+etch2.diff.gz
Size/MD5 checksum:   311809 22b5eafd6a8e6375ffe3fec5533a1d5d
http://security.debian.org/pool/updates/main/o/openldap2.3/openldap2.3_2.3.30-5+etch2.dsc
Size/MD5 checksum:     1205 d266aa1b763c9f0d91f7b062bfb65c86

alpha architecture (DEC Alpha)

http://security.debian.org/pool/updates/main/o/openldap2.3/slapd_2.3.30-5+etch2_alpha.deb
Size/MD5 checksum:  1280050 180958ccc394210e2b04ac1c532118cd
http://security.debian.org/pool/updates/main/o/openldap2.3/libldap-2.3-0_2.3.30-5+etch2_alpha.deb
Size/MD5 checksum:   292722 cb1433274dce06173ea7e97051863c2b
http://security.debian.org/pool/updates/main/o/openldap2.3/ldap-utils_2.3.30-5+etch2_alpha.deb
Size/MD5 checksum:   193424 61f779bea372ee467a4691e219547c21

amd64 architecture (AMD x86_64 (AMD64))

http://security.debian.org/pool/updates/main/o/openldap2.3/slapd_2.3.30-5+etch2_amd64.deb
Size/MD5 checksum:  1244538 37c9d1aba2a53ff6562678a25b6147ef
http://security.debian.org/pool/updates/main/o/openldap2.3/libldap-2.3-0_2.3.30-5+etch2_amd64.deb
Size/MD5 checksum:   285314 a81dd9a9a2d661d95897ca71d5a68527
http://security.debian.org/pool/updates/main/o/openldap2.3/ldap-utils_2.3.30-5+etch2_amd64.deb
Size/MD5 checksum:   184558 e22fd11d64bad96ad7a5c6a76f69c872

arm architecture (ARM)

http://security.debian.org/pool/updates/main/o/openldap2.3/libldap-2.3-0_2.3.30-5+etch2_arm.deb
Size/MD5 checksum:   254636 1537a42a4c76d3c40feb4e35adf10abc
http://security.debian.org/pool/updates/main/o/openldap2.3/ldap-utils_2.3.30-5+etch2_arm.deb
Size/MD5 checksum:   141986 fbda3408d6b35a34cd43875ee39c038a
http://security.debian.org/pool/updates/main/o/openldap2.3/slapd_2.3.30-5+etch2_arm.deb
Size/MD5 checksum:  1188920 b556015d8462a5eff9e5c00cf65658ff

hppa architecture (HP PA RISC)

http://security.debian.org/pool/updates/main/o/openldap2.3/libldap-2.3-0_2.3.30-5+etch2_hppa.deb
Size/MD5 checksum:   292550 a99048fa9bbf6e524a9854c7874481b3
http://security.debian.org/pool/updates/main/o/openldap2.3/slapd_2.3.30-5+etch2_hppa.deb
Size/MD5 checksum:  1304974 8a352883c7359d68ac65bef523c8c37d
http://security.debian.org/pool/updates/main/o/openldap2.3/ldap-utils_2.3.30-5+etch2_hppa.deb
Size/MD5 checksum:   176956 dc8668a17000f0b6c6993dca2aed517a

i386 architecture (Intel ia32)

http://security.debian.org/pool/updates/main/o/openldap2.3/libldap-2.3-0_2.3.30-5+etch2_i386.deb
Size/MD5 checksum:   266054 84bb5bde130cbc49cce8654fbbf145ed
http://security.debian.org/pool/updates/main/o/openldap2.3/ldap-utils_2.3.30-5+etch2_i386.deb
Size/MD5 checksum:   154168 a73aa2fe4c60f7c74dfb7586ad7e9274
http://security.debian.org/pool/updates/main/o/openldap2.3/slapd_2.3.30-5+etch2_i386.deb
Size/MD5 checksum:  1174324 e23a1aa2d33eccb2af662fbe4e5b9f6d

ia64 architecture (Intel ia64)

http://security.debian.org/pool/updates/main/o/openldap2.3/slapd_2.3.30-5+etch2_ia64.deb
Size/MD5 checksum:  1660820 2cd17aac1591b7f6dbc8ad9806ad7821
http://security.debian.org/pool/updates/main/o/openldap2.3/libldap-2.3-0_2.3.30-5+etch2_ia64.deb
Size/MD5 checksum:   379572 112ff502ca043d71907f05ad316aaa0b
http://security.debian.org/pool/updates/main/o/openldap2.3/ldap-utils_2.3.30-5+etch2_ia64.deb
Size/MD5 checksum:   239140 db04191db37a5bf2dec66f115803ed70

mips architecture (MIPS (Big Endian))

http://security.debian.org/pool/updates/main/o/openldap2.3/slapd_2.3.30-5+etch2_mips.deb
Size/MD5 checksum:  1205670 2eae08b5aa3717fa050f24831870a835
http://security.debian.org/pool/updates/main/o/openldap2.3/ldap-utils_2.3.30-5+etch2_mips.deb
Size/MD5 checksum:   185522 9cb2d778a25d6c904bd84abbbc89fddd
http://security.debian.org/pool/updates/main/o/openldap2.3/libldap-2.3-0_2.3.30-5+etch2_mips.deb
Size/MD5 checksum:   258028 4cd6d9a297dc6447e4f8ffb91d1ddddc

mipsel architecture (MIPS (Little Endian))

http://security.debian.org/pool/updates/main/o/openldap2.3/slapd_2.3.30-5+etch2_mipsel.deb
Size/MD5 checksum:  1188250 7fa6e8454be9cc2b5619fd05c088e666
http://security.debian.org/pool/updates/main/o/openldap2.3/libldap-2.3-0_2.3.30-5+etch2_mipsel.deb
Size/MD5 checksum:   258632 369f2d0a5adc823edf8c8dcc7de8a34a
http://security.debian.org/pool/updates/main/o/openldap2.3/ldap-utils_2.3.30-5+etch2_mipsel.deb
Size/MD5 checksum:   186796 9c611e11a90f62302cab63f0561d0d1d

powerpc architecture (PowerPC)

http://security.debian.org/pool/updates/main/o/openldap2.3/slapd_2.3.30-5+etch2_powerpc.deb
Size/MD5 checksum:  1243660 2a68e3d27c0238061fdf2aa841befa23
http://security.debian.org/pool/updates/main/o/openldap2.3/ldap-utils_2.3.30-5+etch2_powerpc.deb
Size/MD5 checksum:   188790 d274c287d39d1a75bb4b6474ac1c6f34
http://security.debian.org/pool/updates/main/o/openldap2.3/libldap-2.3-0_2.3.30-5+etch2_powerpc.deb
Size/MD5 checksum:   272242 896e4fe8de21568e3251f8060c58b145

s390 architecture (IBM S/390)

http://security.debian.org/pool/updates/main/o/openldap2.3/ldap-utils_2.3.30-5+etch2_s390.deb
Size/MD5 checksum:   168388 66e6090f492708f524b83e990857cf83
http://security.debian.org/pool/updates/main/o/openldap2.3/slapd_2.3.30-5+etch2_s390.deb
Size/MD5 checksum:  1240878 8b841b579a2ed5f7c990e5ffbcf76847
http://security.debian.org/pool/updates/main/o/openldap2.3/libldap-2.3-0_2.3.30-5+etch2_s390.deb
Size/MD5 checksum:   291518 c49e29b487788b2d5a2025cedacf5ee6

sparc architecture (Sun SPARC/UltraSPARC)

http://security.debian.org/pool/updates/main/o/openldap2.3/ldap-utils_2.3.30-5+etch2_sparc.deb
Size/MD5 checksum:   155004 ec1fc16d622ec4b1ecf2e2ca8b12d398
http://security.debian.org/pool/updates/main/o/openldap2.3/libldap-2.3-0_2.3.30-5+etch2_sparc.deb
Size/MD5 checksum:   256832 0fd6fcf2e1a0a54917c21009df1172f7
http://security.debian.org/pool/updates/main/o/openldap2.3/slapd_2.3.30-5+etch2_sparc.deb
Size/MD5 checksum:  1167556 0e95399858cd08f38c143e57c25c3db0

补丁安装方法：

1. 手工安装补丁包：

  首先，使用下面的命令来下载补丁软件：
  # wget url  (url是补丁下载链接地址)

  然后，使用下面的命令来安装补丁：  
  # dpkg -i file.deb (file是相应的补丁名)

2. 使用apt-get自动安装补丁包：

   首先，使用下面的命令更新内部数据库：
   # apt-get update
  
   然后，使用下面的命令安装更新软件包：
   # apt-get upgrade

OpenLDAP
--------
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：

http://www.openldap.org/devel/cvsweb.cgi/libraries/liblber/io.c.diff?r1=1.120&r2=1.121&hideattic=1&sortbydate=0

RedHat
------
RedHat已经为此发布了一个安全公告（RHSA-2008:0583-01）以及相应补丁:
RHSA-2008:0583-01：Important: openldap security update
链接：https://www.redhat.com/support/errata/RHSA-2008-0583.html

Gentoo
------
Gentoo已经为此发布了一个安全公告（GLSA-200808-09）以及相应补丁:
GLSA-200808-09：OpenLDAP: Denial of Service vulnerability
链接：http://security.gentoo.org/glsa/glsa-200808-09.xml

所有OpenLDAP用户都应升级到最新版本：

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=net-nds/openldap-2.3.43"

浏览次数：3340
严重程度：0（网友投票）