The rwm overlay in OpenLDAP 2.4.23, 2.4.36, and earlier does not properly count references, which allows remote attackers to cause a denial of service (slapd crash) by unbinding immediately after a search request, which triggers rwm_conn_destroy to free the session context while it is being used by rwm_op_search.

The remote host is running a version of macOS / Mac OS X that is 10.13.x prior to 10.13.6 Security Update 2019-007, 10.14.x prior to 10.14.6 Security Update 2019-002, or 10.15.x prior to 10.15.2. It is, therefore, affected by multiple vulnerabilities :

  - slapd in OpenLDAP before 2.4.30 allows remote attackers     to cause a denial of service (assertion failure and     daemon exit) via an LDAP search query with attrsOnly set     to true, which causes empty attributes to be returned.
    (CVE-2012-1164)

  - libraries/libldap/tls_m.c in OpenLDAP, possibly 2.4.31     and earlier, when using the Mozilla NSS backend, always     uses the default cipher suite even when TLSCipherSuite     is set, which might cause OpenLDAP to use weaker ciphers     than intended and make it easier for remote attackers to     obtain sensitive information. (CVE-2012-2668)

  - The rwm overlay in OpenLDAP 2.4.23, 2.4.36, and earlier     does not properly count references, which allows remote     attackers to cause a denial of service (slapd crash) by     unbinding immediately after a search request, which     triggers rwm_conn_destroy to free the session context     while it is being used by rwm_op_search. (CVE-2013-4449)

  - The deref_parseCtrl function in     servers/slapd/overlays/deref.c in OpenLDAP 2.4.13     through 2.4.40 allows remote attackers to cause a denial     of service (NULL pointer dereference and crash) via an     empty attribute list in a deref control in a search     request. (CVE-2015-1545)

  - tcpdump before 4.9.3 has a heap-based buffer over-read     related to aoe_print in print-aoe.c and lookup_emem in     addrtoname.c. (CVE-2017-16808)

  - tcpdump before 4.9.3 mishandles the printing of SMB data     (issue 1 of 2). (CVE-2018-10103)

  - tcpdump before 4.9.3 mishandles the printing of SMB data     (issue 2 of 2). (CVE-2018-10105)

  - The LDP parser in tcpdump before 4.9.3 has a buffer     over-read in print-ldp.c:ldp_tlv_print().
    (CVE-2018-14461)

  - The ICMP parser in tcpdump before 4.9.3 has a buffer     over-read in print-icmp.c:icmp_print(). (CVE-2018-14462)

  - The VRRP parser in tcpdump before 4.9.3 has a buffer     over-read in print-vrrp.c:vrrp_print(). (CVE-2018-14463)

  - The LMP parser in tcpdump before 4.9.3 has a buffer     over-read in print-lmp.c:lmp_print_data_link_subobjs().
    (CVE-2018-14464)

  - The RSVP parser in tcpdump before 4.9.3 has a buffer     over-read in print-rsvp.c:rsvp_obj_print().
    (CVE-2018-14465)

  - The Rx parser in tcpdump before 4.9.3 has a buffer over-     read in print-rx.c:rx_cache_find() and     rx_cache_insert(). (CVE-2018-14466)

  - The BGP parser in tcpdump before 4.9.3 has a buffer     over-read in print-bgp.c:bgp_capabilities_print()     (BGP_CAPCODE_MP). (CVE-2018-14467)

  - The FRF.16 parser in tcpdump before 4.9.3 has a buffer     over-read in print-fr.c:mfr_print(). (CVE-2018-14468)

  - The IKEv1 parser in tcpdump before 4.9.3 has a buffer     over-read in print-isakmp.c:ikev1_n_print().
    (CVE-2018-14469)

  - The Babel parser in tcpdump before 4.9.3 has a buffer     over-read in print-babel.c:babel_print_v2().
    (CVE-2018-14470)

  - The command-line argument parser in tcpdump before 4.9.3     has a buffer overflow in tcpdump.c:get_next_file().
    (CVE-2018-14879)

  - The OSPFv3 parser in tcpdump before 4.9.3 has a buffer     over-read in print-ospf6.c:ospf6_print_lshdr().
    (CVE-2018-14880)

  - The BGP parser in tcpdump before 4.9.3 has a buffer     over-read in print-bgp.c:bgp_capabilities_print()     (BGP_CAPCODE_RESTART). (CVE-2018-14881)

  - The ICMPv6 parser in tcpdump before 4.9.3 has a buffer     over-read in print-icmp6.c. (CVE-2018-14882)

  - The IEEE 802.11 parser in tcpdump before 4.9.3 has a     buffer over-read in print-802_11.c for the Mesh Flags     subfield. (CVE-2018-16227)

  - The HNCP parser in tcpdump before 4.9.3 has a buffer     over-read in print-hncp.c:print_prefix().
    (CVE-2018-16228)

  - The DCCP parser in tcpdump before 4.9.3 has a buffer     over-read in print-dccp.c:dccp_print_option().
    (CVE-2018-16229)

  - The BGP parser in tcpdump before 4.9.3 has a buffer     over-read in print-bgp.c:bgp_attr_print()     (MP_REACH_NLRI). (CVE-2018-16230)

  - The BGP parser in tcpdump before 4.9.3 allows stack     consumption in print-bgp.c:bgp_attr_print() because of     unlimited recursion. (CVE-2018-16300)

  - libpcap before 1.9.1, as used in tcpdump before 4.9.3,     has a buffer overflow and/or over-read because of errors     in pcapng reading. (CVE-2018-16301)

  - The SMB parser in tcpdump before 4.9.3 has buffer over-     reads in print-smb.c:print_trans() for \MAILSLOT\BROWSE     and \PIPE\LANMAN. (CVE-2018-16451)

  - The SMB parser in tcpdump before 4.9.3 has stack     exhaustion in smbutil.c:smb_fdata() via recursion.
    (CVE-2018-16452)

  - An issue was discovered in the server in OpenLDAP before     2.4.48. When the server administrator delegates rootDN     (database admin) privileges for certain databases but     wants to maintain isolation (e.g., for multi-tenant     deployments), slapd does not properly stop a rootDN from     requesting authorization as an identity from another     database during a SASL bind or with a proxyAuthz (RFC     4370) control. (It is not a common configuration to     deploy a system where the server administrator and a DB     administrator enjoy different levels of trust.)     (CVE-2019-13057)

  - An issue was discovered in OpenLDAP 2.x before 2.4.48.
    When using SASL authentication and session encryption,     and relying on the SASL security layers in slapd access     controls, it is possible to obtain access that would     otherwise be denied via a simple bind for any identity     covered in those ACLs. After the first SASL bind is     completed, the sasl_ssf value is retained for all new     non-SASL connections. Depending on the ACL     configuration, this can affect different types of     operations (searches, modifications, etc.). In other     words, a successful authorization step completed by one     user affects the authorization requirement for a     different user. (CVE-2019-13565)

  - rpcapd/daemon.c in libpcap before 1.9.1 mishandles     certain length values because of reuse of a variable.
    This may open up an attack vector involving extra data     at the end of a request. (CVE-2019-15161)

  - rpcapd/daemon.c in libpcap before 1.9.1 on non-Windows     platforms provides details about why authentication     failed, which might make it easier for attackers to     enumerate valid usernames. (CVE-2019-15162)

  - rpcapd/daemon.c in libpcap before 1.9.1 allows attackers     to cause a denial of service (NULL pointer dereference     and daemon crash) if a crypt() call fails.
    (CVE-2019-15163)

  - rpcapd/daemon.c in libpcap before 1.9.1 allows SSRF     because a URL may be provided as a capture source.
    (CVE-2019-15164)

  - sf-pcapng.c in libpcap before 1.9.1 does not properly     validate the PHB header length before allocating memory.
    (CVE-2019-15165)

  - lmp_print_data_link_subobjs() in print-lmp.c in tcpdump     before 4.9.3 lacks certain bounds checks.
    (CVE-2019-15166)

  - In libexpat before 2.2.8, crafted XML input could fool     the parser into changing from DTD parsing to document     parsing too early; a consecutive call to     XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber)     then resulted in a heap-based buffer over-read.
    (CVE-2019-15903)

Note that Nessus has not tested for this issue but has instead relied only on the operating system's self-reported version number.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - CVE-2015-6908 openldap: ber_get_next denial of service     vulnerability (#1263170)

  - fix: syncprov psearch race condition (#999811)

  - fix: CVE-2013-4449 segfault on certain queries with rwm     overlay (#1064146)

  - fix: do not send IPv6 DNS queries when IPv6 is disabled     on the host (#812772)

  - fix: disable static libraries stripping (#684630)

  - fix: memory leaks in syncrepl and slap_sl_free (#741184)

  - new feature update: honor priority/weight with     ldap_domain2hostlist (#733435)

  - fix: initscript marked as %config incorrectly (#738768)

  - new feature: honor priority/weight with     ldap_domain2hostlist (#733435)

  - fix: strict aliasing warnings during package build     (#732381)

  - fix: OpenLDAP packages lack debug data (#684630)

  - doc: Document preferred use of TLS_CACERT instead of     TLS_CACERTDIR to specify Certificate Authorities     (#699652)

  - fix: libldap ignores a directory of CA certificates if     any of them can't be read (#609722)

  - fix: Migration: migrate_all_offline.sh can't handle     duplicate entries (#563148)

  - fix: Init script is working wrong if database recovery     is needed (#604092)

  - fix: CVE-2011-1024 ppolicy forwarded bind failure     messages cause success (#680486)

  - fix: slapd concurrent access to connections causes slapd     to silently die (#641953)

  - backport: ldap_init_fd API function

  - fix: ppolicy crash while replace-deleting userPassword     attribute (#665951)

  - fix: connection freeze when using TLS (#591419)

  - don't remove task twice during replication

  - fixed segfault issues in modrdn (#606375)

  - added patch handling null char in TLS to compat package     (#606375, patch backported by Jan Vcelak )

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2622-1 advisory.

    It was discovered that OpenLDAP incorrectly handled certain search queries that returned empty attributes.
    A remote attacker could use this issue to cause OpenLDAP to assert, resulting in a denial of service. This     issue only affected Ubuntu 12.04 LTS. (CVE-2012-1164)

    Michael Vishchers discovered that OpenLDAP improperly counted references when the rwm overlay was used. A     remote attacker could use this issue to cause OpenLDAP to crash, resulting in a denial of service.
    (CVE-2013-4449)

    It was discovered that OpenLDAP incorrectly handled certain empty attribute lists in search requests. A     remote attacker could use this issue to cause OpenLDAP to crash, resulting in a denial of service.
    (CVE-2015-1545)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

openldap2 was updated to fix three security issues and one non-security bug.

The following vulnerabilities were fixed :

  - A remote attacker could cause a denial of service (slapd     crash) by unbinding immediately after a search request.
    (bnc#846389, CVE-2013-4449)

  - A remote attacker could cause a denial of service     through a NULL pointer dereference and crash via an     empty attribute list in a deref control in a search     request. (bnc#916897, CVE-2015-1545)

  - A remote attacker could cause a denial of service     (crash) via a crafted search query with a matched values     control. (bnc#916914, CVE-2015-1546) The following     non-security bug was fixed :

  - Prevent connection-0 (internal connection) from showing     up in the monitor back-end. (bnc#905959)

Multiple vulnerabilities were found in OpenLDAP, a free implementation of the Lightweight Directory Access Protocol.

  - CVE-2013-4449     Michael Vishchers from Seven Principles AG discovered a     denial of service vulnerability in slapd, the directory     server implementation. When the server is configured to     used the RWM overlay, an attacker can make it crash by     unbinding just after connecting, because of an issue     with reference counting.

  - CVE-2014-9713     The default Debian configuration of the directory     database allows every users to edit their own     attributes. When LDAP directories are used for access     control, and this is done using user attributes, an     authenticated user can leverage this to gain access to     unauthorized resources.

  Please note this is a Debian specific vulnerability.

  The new package won't use the unsafe access control rule for new   databases, but existing configurations won't be automatically   modified. Administrators are incited to look at the README.Debian   file provided by the updated package if they need to fix the access   control rule.

  - CVE-2015-1545     Ryan Tandy discovered a denial of service vulnerability     in slapd. When using the deref overlay, providing an     empty attribute list in a query makes the daemon     crashes.

CVE-2013-4449: segfault on certain queries with rwm overlay (#1060851) Update to 2.4.39 (#1067818)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A denial of service flaw was found in the way the OpenLDAP server daemon (slapd) performed reference counting when using the rwm (rewrite/remap) overlay. A remote attacker able to query the OpenLDAP server could use this flaw to crash the server by immediately unbinding from the server after sending a search request.
(CVE-2013-4449)

Updated openldap packages that fix one security issue are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

OpenLDAP is an open source suite of Lightweight Directory Access Protocol (LDAP) applications and development tools. LDAP is a set of protocols used to access and maintain distributed directory information services over an IP network. The openldap package contains configuration files, libraries, and documentation for OpenLDAP.

A denial of service flaw was found in the way the OpenLDAP server daemon (slapd) performed reference counting when using the rwm (rewrite/remap) overlay. A remote attacker able to query the OpenLDAP server could use this flaw to crash the server by immediately unbinding from the server after sending a search request.
(CVE-2013-4449)

Red Hat would like to thank Michael Vishchers from Seven Principles AG for reporting this issue.

All openldap users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2014-0206 advisory.

    - fix: CVE-2013-4449 segfault on certain queries with rwm overlay (#1064145)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A vulnerability has been discovered and corrected in openldap :

The rwm overlay in OpenLDAP 2.4.23, 2.4.36, and earlier does not properly count references, which allows remote attackers to cause a denial of service (slapd crash) by unbinding immediately after a search request, which triggers rwm_conn_destroy to free the session context while it is being used by rwm_op_search (CVE-2013-4449).

The updated packages have been patched to correct this issue.

fix rmw reference counting bug new upstream release (#1059186);
http://www.openldap.org/software/release/changes.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A denial of service flaw was found in the way the OpenLDAP server daemon (slapd) performed reference counting when using the rwm (rewrite/remap) overlay. A remote attacker able to query the OpenLDAP server could use this flaw to crash the server by immediately unbinding from the server after sending a search request.
(CVE-2013-4449)

This update also fixes the following bug :

  - Previously, OpenLDAP did not properly handle a number of     simultaneous updates. As a consequence, sending a number     of parallel update requests to the server could cause a     deadlock. With this update, a superfluous locking     mechanism causing the deadlock has been removed, thus     fixing the bug.

Updated openldap packages that fix one security issue and one bug are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

OpenLDAP is an open source suite of Lightweight Directory Access Protocol (LDAP) applications and development tools. LDAP is a set of protocols used to access and maintain distributed directory information services over an IP network. The openldap package contains configuration files, libraries, and documentation for OpenLDAP.

A denial of service flaw was found in the way the OpenLDAP server daemon (slapd) performed reference counting when using the rwm (rewrite/remap) overlay. A remote attacker able to query the OpenLDAP server could use this flaw to crash the server by immediately unbinding from the server after sending a search request.
(CVE-2013-4449)

Red Hat would like to thank Michael Vishchers from Seven Principles AG for reporting this issue.

This update also fixes the following bug :

* Previously, OpenLDAP did not properly handle a number of simultaneous updates. As a consequence, sending a number of parallel update requests to the server could cause a deadlock. With this update, a superfluous locking mechanism causing the deadlock has been removed, thus fixing the bug. (BZ#1056124)

All openldap users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2014-0126 advisory.

    [2.4.23-34.1]
    - fix: segfault on certain queries with rwm overlay (#1058250)

    [2.4.23-34]
    - fix: deadlock during SSL_ForceHandshake (#996373)       + revert nss-handshake-threadsafe.patch

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
131957	macOS 10.15.x < 10.15.2 / 10.14.x < 10.14.6 Security Update 2019-002 / 10.13.x < 10.13.6 Security Update 2019-007	Nessus	MacOS X Local Security Checks	critical
91749	OracleVM 3.2 : openldap (OVMSA-2016-0069)	Nessus	OracleVM Local Security Checks	medium
83863	Ubuntu 14.04 LTS : OpenLDAP vulnerabilities (USN-2622-1)	Nessus	Ubuntu Local Security Checks	critical
83516	SuSE 11.3 Security Update : openldap2 (SAT Patch Number 10635)	Nessus	SuSE Local Security Checks	medium
82432	Debian DSA-3209-1 : openldap - security update	Nessus	Debian Local Security Checks	medium
72913	Fedora 19 : openldap-2.4.39-2.fc19 (2014-2967)	Nessus	Fedora Local Security Checks	medium
72750	Amazon Linux AMI : openldap (ALAS-2014-294)	Nessus	Amazon Linux Local Security Checks	medium
72680	Scientific Linux Security Update : openldap on SL5.x i386/x86_64 (20140224)	Nessus	Scientific Linux Local Security Checks	medium
72679	RHEL 5 : openldap (RHSA-2014:0206)	Nessus	Red Hat Local Security Checks	medium
72677	Oracle Linux 5 : openldap (ELSA-2014-0206)	Nessus	Oracle Linux Local Security Checks	critical
72673	CentOS 5 : openldap (CESA-2014:0206)	Nessus	CentOS Local Security Checks	medium
72467	Mandriva Linux Security Advisory : openldap (MDVSA-2014:026)	Nessus	Mandriva Local Security Checks	medium
72451	Fedora 20 : openldap-2.4.39-2.fc20 (2014-2012)	Nessus	Fedora Local Security Checks	medium
72276	Scientific Linux Security Update : openldap on SL6.x i386/x86_64 (20140203)	Nessus	Scientific Linux Local Security Checks	medium
72273	RHEL 6 : openldap (RHSA-2014:0126)	Nessus	Red Hat Local Security Checks	medium
72271	Oracle Linux 6 : openldap (ELSA-2014-0126)	Nessus	Oracle Linux Local Security Checks	critical
72267	CentOS 6 : openldap (CESA-2014:0126)	Nessus	CentOS Local Security Checks	medium

Detections

Analytics

CVE-2013-4449

critical

Tenable Plugins

critical

medium

critical

medium

medium

medium

medium

medium

medium

critical

medium

medium

medium

medium

medium

critical

medium