Bug 1226277 (CVE-2024-5953)

Summary: VUL-0: CVE-2024-5953: 389-ds: malformed userPassword hashes may cause a denial of service
Product: [Novell Products] SUSE Security Incidents Reporter: SMASH SMASH <smash_bz>
Component: IncidentsAssignee: William Brown <william.brown>
Status: NEW --- QA Contact: Security Team bot <security-team>
Severity: Normal    
Priority: P3 - Medium CC: camila.matos
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/410435/
Whiteboard: CVSSv3.1:SUSE:CVE-2024-5953:6.5:(AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Found By: Security Response Team Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description SMASH SMASH 2024-06-13 10:13:31 UTC 
A denial of service vulnerability was found in 389-ds-base ldap server. This issue may allow an authenticated user to cause a server crash or hang while authenticating with an user having a malformed userPassword.
By default only the administrator may directly add hashed password that can trigger the issue. But if nsslapd-allow-hashed-passwords config parameter is turned on, any user can trigger the issue. 

The problem is triggered by adding a password to an user using the hashed format (with a hash value too long for the specified hash scheme)
Then later on when trying to authenticate on that user its triggers the buffer overflow

By default, only  administrators are allowed to add hashed passwords but there is a configuration parameter (nsslapd-allow-hashed-passwords) allowing any users to add hashed passwords and potentially trigger the DoS. 

This vulnerability affects versions: >= 1.3.7.2

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-5953
https://bugzilla.redhat.com/show_bug.cgi?id=2292104