CVE-2015-1545

The deref_parseCtrl function in servers/slapd/overlays/deref.c in OpenLDAP 2.4.13 through 2.4.40 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an empty attribute list in a deref control in a search request.

Updated openldap packages fix security vulnerability:

The deref overlay in slapd 2.4.13 through 2.4.40 dereferences a NULL pointer when a search request includes the Deref control with an empty list of attributes to return (missing input validation). This allows a remote unauthenticated client to crash the LDAP server (CVE-2015-1545).

These are all security issues fixed in the libldap-2_4-2-2.4.59-69.3 package on the GA media of openSUSE Tumbleweed.

openldap2 was updated to fix three security issues and one non-security bug.

The following vulnerabilities were fixed:

* A remote attacker could cause a denial of service (slapd crash) by
  unbinding immediately after a search request. (bnc#846389,
  CVE-2013-4449)
* A remote attacker could cause a denial of service through a NULL
  pointer dereference and crash via an empty attribute list in a deref
  control in a search request. (bnc#916897, CVE-2015-1545)
* A remote attacker could cause a denial of service (crash) via a
  crafted search query with a matched values control. (bnc#916914,
  CVE-2015-1546)

The following non-security bug was fixed:

* Prevent connection-0 (internal connection) from showing up in the
  monitor back-end. (bnc#905959)

Security Issues:

* CVE-2015-1546
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1546>
* CVE-2015-1545
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1545>
* CVE-2013-4449
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4449>

openldap2 was updated to fix two security issues and one non-security bug.

The following vulnerabilities were fixed:

• A remote attacker could cause a denial of service through a NULL pointer dereference and crash via an empty attribute list in a deref control in a search request. (bnc#916897 CVE-2015-1545)
• A remote attacker could cause a denial of service (crash) via a crafted search query with a matched values control. (bnc#916914 CVE-2015-1546)

The following non-security issue was fixed:

• Prevent connection-0 (internal connection) from showing up in the monitor backend (bnc#905959)

The deref_parseCtrl function in servers/slapd/overlays/deref.c in OpenLDAP 2.4.13 through 2.4.40 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an empty attribute list in a deref control in a search request.

It was discovered that OpenLDAP incorrectly handled certain search queries that returned empty attributes. A remote attacker could use this issue to cause OpenLDAP to assert, resulting in a denial of service. This issue only affected Ubuntu 12.04 LTS. (CVE-2012-1164)

Michael Vishchers discovered that OpenLDAP improperly counted references when the rwm overlay was used. A remote attacker could use this issue to cause OpenLDAP to crash, resulting in a denial of service. (CVE-2013-4449)

It was discovered that OpenLDAP incorrectly handled certain empty attribute lists in search requests. A remote attacker could use this issue to cause OpenLDAP to crash, resulting in a denial of service. (CVE-2015-1545)