[Date Prev][Date Next] [Chronological] [Thread] [Top]

OpenLDAP 2.4.45 possible denial of service vulnerability?

Hi,

After upgrading to the latest Release (Solaris 11.3 SRU35, OpenLDAP 2.4.45) we are experiencing massive workloads caused by single clients consuming all available threads and CPU-resources. Service does not longer respond to requests, even cn=monitor on loopback interface stops to respond properly.

OS:
# pkg info entire
             Name: entire
          Summary: entire incorporation including Support Repository Update (Oracle Solaris 11.3.35.6.0).
      Description: This package constrains system package versions to the same
                   build.  WARNING: Proper system update and correct package
                   selection depend on the presence of this incorporation.
                   Removing this package will result in an unsupported system.
                   For more information see:
                   https://support.oracle.com/rs?type=doc&id=2045311.1
         Category: Meta Packages/Incorporations
            State: Installed
        Publisher: solaris
          Version: 0.5.11 (Oracle Solaris 11.3.35.6.0)
    Build Release: 5.11
           Branch: 0.175.3.35.0.6.0
   Packaging Date: August 10, 2018 03:22:59 PM
             Size: 5.46 kB
             FMRI: pkg://solaris/entire@0.5.11,5.11-0.175.3.35.0.6.0:20180810T152259Z

OpenSSL:
# pkg info entire
             Name: entire
          Summary: entire incorporation including Support Repository Update (Oracle Solaris 11.3.35.6.0).
      Description: This package constrains system package versions to the same
                   build.  WARNING: Proper system update and correct package
                   selection depend on the presence of this incorporation.
                   Removing this package will result in an unsupported system.
                   For more information see:
                   https://support.oracle.com/rs?type=doc&id=2045311.1
         Category: Meta Packages/Incorporations
            State: Installed
        Publisher: solaris
          Version: 0.5.11 (Oracle Solaris 11.3.35.6.0)
    Build Release: 5.11
           Branch: 0.175.3.35.0.6.0
   Packaging Date: August 10, 2018 03:22:59 PM
             Size: 5.46 kB
             FMRI: pkg://solaris/entire@0.5.11,5.11-0.175.3.35.0.6.0:20180810T152259Z

OpenLDAP:
# pkg info entire
             Name: entire
          Summary: entire incorporation including Support Repository Update (Oracle Solaris 11.3.35.6.0).
      Description: This package constrains system package versions to the same
                   build.  WARNING: Proper system update and correct package
                   selection depend on the presence of this incorporation.
                   Removing this package will result in an unsupported system.
                   For more information see:
                   https://support.oracle.com/rs?type=doc&id=2045311.1
         Category: Meta Packages/Incorporations
            State: Installed
        Publisher: solaris
          Version: 0.5.11 (Oracle Solaris 11.3.35.6.0)
    Build Release: 5.11
           Branch: 0.175.3.35.0.6.0
   Packaging Date: August 10, 2018 03:22:59 PM
             Size: 5.46 kB
             FMRI: pkg://solaris/entire@0.5.11,5.11-0.175.3.35.0.6.0:20180810T152259Z

Part of slapd.conf:
loglevel none stats sync
sizelimit 15000
timelimit 30
threads 64
tool-threads 8
idletimeout  0
writetimeout 0

security        tls=0

conn_max_pending 100
conn_max_pending_auth 1000

database        mdb
suffix  "dc=scom"
rootdn  "cn=*****"
rootpw  {SSHA}*****

maxsize         17179869184
maxreaders      4096
searchstack     64
checkpoint      0 1
dbnosync

Machine is a X6-2, 44 cores, 88 threads, 256GB RAM:
# prtdiag
System Configuration: Oracle Corporation ORACLE SERVER X6-2
BIOS Configuration: American Megatrends Inc. 38070000 12/16/2016
BMC Configuration: IPMI 2.0 (KCS: Keyboard Controller Style)

==== Processor Sockets ====================================

Version                          Location Tag
-------------------------------- --------------------------
Intel(R) Xeon(R) CPU E5-2699 v4 @ 2.20GHz P0
Intel(R) Xeon(R) CPU E5-2699 v4 @ 2.20GHz P1

Even monitoring (cn=monitor) is no longer accessible when this occurs.

So far we experienced this behavior with clients of Oracle Enterprise Linux 6.x, Redhat Enterprise Linux 6.x and AIX. Service requests are opened at vendors support, but I'd prefer to have an installation which is less vulnerable and more resilient to issues of this kind.

No problems or issues with Solaris and HPUX clients.

Has anyone experienced similar problems or suggestions for configuration?

To avoid performance issues loglevel is now "none stats sync" but can be changed for some time to track down the cause.

Best regards

Jürgen Sprenger