Description
Off-by-one error in the UTF8StringNormalize function in OpenLDAP 2.4.26 and earlier allows remote attackers to cause a denial of service (slapd crash) via a zero-length string that triggers a heap-based buffer overflow, as demonstrated using an empty postalAddressAttribute value in an LDIF entry.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openldap | 2.4.28-1 | — |
| Debian 13 | openldap | 2.4.28-1 | — |
| Debian 12 | openldap | 2.4.28-1 | — |
References
- GLSA-201406-36 vendor-advisory
- [oss-security] 20111026 CVE Request: openldap2 UTF8StringNormalize() can cause a (one-byte) buffer overflow mailing-list
- http://www.openldap.org/its/index.cgi/Software%20Bugs?id=7059%3Bselectid=7059
- https://bugzilla.redhat.com/show_bug.cgi?id=749324
- USN-1266-1 vendor-advisory
- 46599 third-party-advisory
- http://www.openldap.org/devel/gitweb.cgi?p=openldap.git%3Ba=commitdiff%3Bh=507238713b71208ec4f262f312cb495a302df9e9
- 50384 vdb-entry
- openldap-utf8stringnormalize-dos(70991) vdb-entry
- [oss-security] 20111026 Re: CVE Request: openldap2 UTF8StringNormalize() can cause a (one-byte) buffer overflow mailing-list