[Date Prev][Date Next]
[Chronological]
[Thread]
[Top]
Re: (ITS#9124) Unauthenticated remote denial-of-service (Null pointer dereference in ber_skip_tag)
- To: openldap-its@OpenLDAP.org
- Subject: Re: (ITS#9124) Unauthenticated remote denial-of-service (Null pointer dereference in ber_skip_tag)
- From: ondra@mistotebe.net
- Date: Fri, 29 Nov 2019 12:06:36 +0000
- Auto-submitted: auto-generated (OpenLDAP-ITS)
On Fri, Nov 29, 2019 at 09:08:15AM +0000, stephan@srlabs.de wrote:
> Unauthenticated remote denial-of-service through malformed ldap packet
> caused by a null pointer dereference in ber_skip_tag function
> (libraries/liblber/decode.c).
>
> ==4066091== by 0x4FD051: cancel_extop (cancel.c:52)
Hi Stephan,
thanks for the report, this should be fixed by commit
1dbf0e9441def3d6dbc0fa8fba3c2e86fa50fa19 in master.
Looks like you are fuzzing the server which has been on my to do list
for a while, many thanks for that and I'm looking forward to reading
how you did it. Would you be willing to help the project integrate your
work in its testing process after you've finished?
Thanks,
--
OndÅ?ej KuznÃk
Senior Software Engineer
Symas Corporation http://www.symas.com
Packaged, certified, and supported LDAP solutions powered by OpenLDAP