Bug 916914 - (CVE-2015-1546) VUL-0: CVE-2015-1546: openldap2: slapd crash in valueReturnFilter cleanup
(CVE-2015-1546)
VUL-0: CVE-2015-1546: openldap2: slapd crash in valueReturnFilter cleanup
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Normal
: ---
Assigned To: Peter Varkoly
Security Team bot
https://smash.suse.de/issue/113617/
maint:released:sle11-sp1:61598
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2015-02-09 13:08 UTC by Johannes Segitz
Modified: 2017-06-07 10:02 UTC (History)
9 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Comment 1 Swamp Workflow Management 2015-02-09 23:04:50 UTC
bugbot adjusting priority
Comment 2 Victor Pereira 2015-02-10 16:00:16 UTC
the report http://www.openldap.org/its/?findid=8046
Comment 3 Victor Pereira 2015-02-10 16:00:31 UTC
a reproducer  ldapsearch -E 'mv=(cn={*)(sn=*)'
Comment 6 Swamp Workflow Management 2015-02-12 10:45:22 UTC
An update workflow for this issue was started.
This issue was rated as moderate.
Please submit fixed packages until 2015-02-26.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/60662
Comment 10 Howard Guo 2015-04-09 12:29:38 UTC
Cannot reproduce in SLES 11. Which product is affected?
Comment 11 Marcus Meissner 2015-04-09 14:18:36 UTC
the code in sle11 is wrong on visual inspection at least.

void
vrFilter_free( Operation *op, ValuesReturnFilter *vrf )
{
        ValuesReturnFilter      *p, *next;

        if ( vrf == NULL ) {
                return;
        }

        for ( p = vrf; p != NULL; p = next ) {
                next = p->vrf_next;

                switch ( vrf->vrf_choice & SLAPD_FILTER_MASK ) {
                case LDAP_FILTER_PRESENT:


The loop never changes vrf, so the switch will always use the passed in vrf, which was actually already freed in the first loop iteration.

So vrf needs to change with every loop, like the patch in 

http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=commitdiff;h=2f1a2dd329b91afe561cd06b872d09630d4edb6a

does. it can be taken 1:1 I think
Comment 12 Howard Guo 2015-04-09 14:58:47 UTC
Patch is applied. Update submitted to SP3:Updates.
Comment 15 Swamp Workflow Management 2015-05-15 20:05:54 UTC
SUSE-SU-2015:0887-1: An update that solves three vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 846389,905959,916897,916914
CVE References: CVE-2013-4449,CVE-2015-1545,CVE-2015-1546
Sources used:
SUSE Linux Enterprise Software Development Kit 11 SP3 (src):    openldap2-2.4.26-0.30.1, openldap2-client-2.4.26-0.30.1
SUSE Linux Enterprise Server 11 SP3 for VMware (src):    openldap2-2.4.26-0.30.1, openldap2-client-2.4.26-0.30.1
SUSE Linux Enterprise Server 11 SP3 (src):    openldap2-2.4.26-0.30.1, openldap2-client-2.4.26-0.30.1
SUSE Linux Enterprise Security Module 11 SP3 (src):    openldap2-client-openssl1-2.4.26-0.30.2
SUSE Linux Enterprise Desktop 11 SP3 (src):    openldap2-client-2.4.26-0.30.1
Comment 16 Swamp Workflow Management 2015-06-18 07:05:42 UTC
SUSE-SU-2015:1077-1: An update that solves two vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 905959,916897,916914
CVE References: CVE-2015-1545,CVE-2015-1546
Sources used:
SUSE Linux Enterprise Software Development Kit 12 (src):    openldap2-2.4.39-15.1, openldap2-2.4.39-16.1, openldap2-client-2.4.39-15.1, openldap2-client-2.4.39-16.1
SUSE Linux Enterprise Server 12 (src):    openldap2-2.4.39-15.1, openldap2-2.4.39-16.1, openldap2-client-2.4.39-15.1, openldap2-client-2.4.39-16.1
SUSE Linux Enterprise Module for Legacy Software 12 (src):    openldap2-2.4.39-15.1, openldap2-2.4.39-16.1
SUSE Linux Enterprise Desktop 12 (src):    openldap2-client-2.4.39-16.1
 12 (src):    openldap2-2.4.39-16.1
Comment 17 Bernhard Wiedemann 2015-07-10 13:00:25 UTC
This is an autogenerated message for OBS integration:
This bug (916914) was mentioned in
https://build.opensuse.org/request/show/315869 13.2 / openldap2
Comment 18 Andreas Stieger 2015-07-20 12:11:35 UTC
Review open for 10 days, please review:
https://build.opensuse.org/request/show/315869
Comment 19 Andreas Stieger 2015-07-23 07:44:47 UTC
Maintenance request in review for 13 days, can you please review:
https://build.opensuse.org/request/show/315869

I believe Viktor did not submit this to the devel project. Can you please ensure the SLE patches are brought into Factory?
Comment 20 Victor Pereira 2015-07-23 08:49:40 UTC
in the meantime i did it as for OpenSUSE 13.1...
Comment 21 Bernhard Wiedemann 2015-07-23 09:00:38 UTC
This is an autogenerated message for OBS integration:
This bug (916914) was mentioned in
https://build.opensuse.org/request/show/318094 13.1 / openldap2
Comment 22 Swamp Workflow Management 2015-07-31 08:27:44 UTC
openSUSE-SU-2015:1325-1: An update that solves two vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 905959,916897,916914
CVE References: CVE-2015-1545,CVE-2015-1546
Sources used:
openSUSE 13.2 (src):    openldap2-2.4.39-8.5.1, openldap2-client-2.4.39-8.5.1
openSUSE 13.1 (src):    openldap2-2.4.33-8.3.1, openldap2-client-2.4.33-8.3.1
Comment 23 Howard Guo 2015-09-22 09:48:02 UTC
The updates have been released.
Comment 27 Bernhard Wiedemann 2017-06-06 14:02:03 UTC
This is an autogenerated message for OBS integration:
This bug (916914) was mentioned in
https://build.opensuse.org/request/show/501412 Factory / openldap2
Comment 28 Bernhard Wiedemann 2017-06-07 10:02:29 UTC
This is an autogenerated message for OBS integration:
This bug (916914) was mentioned in
https://build.opensuse.org/request/show/501631 Factory / openldap2