LDAP vulnerabilities

Updated 3/18/03

Impact

If an application uses a vulnerable implementation of LDAP, an attacker could cause a denial of service or execute arbitrary commands.

Background

A directory service is used to keep track of network entities such as files, applications, printers, and users. The Lightweight Directory Access Protocol (LDAP) is one protocol which can be used to access directory services. Many applications, such as mail servers, enterprise servers, and databases, use LDAP to provide directory access while conserving resources.

The Problem

7/19/01
Many implementations of the LDAP protocol do not properly handle requests which do not adhere to the expected format. Among the problems which may be present are buffer overflow conditions, format string vulnerabilities, and mishandling of requests which violate encoding rules. Exploitation of these problems could lead to denial of service or unauthorized access.

The following applications contain an implementation of LDAP which contains such vulnerabilities if unpatched:

Resolution

See CERT Advisory 2001-18 for information on obtaining a patch for your application. OpenLDAP 2.x users may also need to fix a separate set of vulnerabilities which were reported in SuSE Security Announcement 2002:047. Consult your vendor for a fix.

If a patch is not available, then ports 389 and 636, TCP and UDP, should be blocked at the network perimeter until a patch can be applied.

Where can I read more about this?

For more information, see CERT Advisory 2001-18 and SuSE Security Announcement 2002:047.