Check Point Advisories

OpenLDAP ber_get_next BER Decoding Denial of Service

Check Point Reference:	CPAI-2008-223
Date Published:	10 Oct 2008
Severity:	Medium
Last Updated:	Tuesday 01 January, 2008
Source:	OpenLDAP Foundation
Industry Reference:	CVE-2008-2952
Protection Provided by:
Who is Vulnerable?	OpenLDAP Foundation OpenLDAP 2.4.10 and prior OpenLDAP Foundation OpenLDAP 2.3.42 and prior OpenLDAP Foundation OpenLDAP 2.2.x OpenLDAP Foundation OpenLDAP 2.1.x
Vulnerability Description	A denial of service vulnerability exists in OpenLDAP. OpenLDAP is an open-source implementation of the Lightweight Directory Access Protocol (LDAP) service. LDAP messages are defined using Abstract Syntax Notation One (ASN.1). OpenLDAP fails to properly handle crafted ASN.1 packets, allowing remote attackers to deny services on vulnerable installations of OpenLDAP. Authentication is not required to exploit this vulnerability.
Vulnerability Details	The specific flaw exists in the decoding of ASN.1 BER network datagrams. When the size of a BerElement is specified incorrectly, the application will trigger an assert(), leading to abnormal program termination. An attacker can trigger this issue by sending a specially crafted ASN.1 BER encoded packet to a vulnerable Open LDAP installation.