6759335 2001-07-17 08:55 -0600 /616 rader/ <aleph1@securityfocus.com>
Sänt av: joel@lysator.liu.se
Importerad: 2001-07-17 17:52 av Brevbäraren
Extern mottagare: bugtraq@securityfocus.com
Mottagare: Bugtraq (import) <18028>
Ärende: CERT Advisory CA-2001-18
------------------------------------------------------------
From: aleph1@securityfocus.com
To: bugtraq@securityfocus.com
Message-ID: <20010717085523.I9567@securityfocus.com>
-----BEGIN PGP SIGNED MESSAGE-----
CERT Advisory CA-2001-18 Multiple Vulnerabilities in Several
Implementations of the Lightweight Directory Access Protocol (LDAP)
Original release date: July 16, 2001
Last revised: --
Source: CERT/CC
A complete revision history can be found at the end of this file.
Systems Affected
* iPlanet Directory Server, version 5.0 Beta and versions up to and
including 4.13
* Certain versions of IBM SecureWay running under Solaris and
Windows 2000
* Lotus Domino R5 Servers (Enterprise, Application, and Mail),
prior
to 5.0.7a
* Teamware Office for Windows NT and Solaris, prior to version
5.3ed1
* Qualcomm Eudora WorldMail for Windows NT, version 2
* Microsoft Exchange 5.5 LDAP Service (Hotfix pending)
* Network Associates PGP Keyserver 7.0, prior to Hotfix 2
* Oracle 8i Enterprise Edition
* OpenLDAP, 1.x prior to 1.2.12 and 2.x prior to 2.0.8
Overview
Several implementations of the Lightweight Directory Access
Protocol (LDAP) protocol contain vulnerabilities that may allow
denial-of-service attacks, unauthorized privileged access, or both.
If
your site uses any of the products listed in this advisory, the
CERT/CC
encourages you to follow the advice provided in the Solution section
below.
I. Description
The LDAP protocol provides access to directories that support the
X.500
directory semantics without requiring the additional resources of
X.500. A directory is a collection of information such as names,
addresses, access control lists, and cryptographic certificates.
Because LDAP servers are widely used in maintaining corporate contact
information and providing authentication services, any threats to
their
integrity or stability can jeopardize the security of an
organization.
To test the security of protocols like LDAP, the PROTOS project
presents a server with a wide variety of sample packets containing
unexpected values or illegally formatted data. This approach may
reveal
vulnerabilities that would not manifest themselves under normal
conditions. As a member of the PROTOS project consortium, the Oulu
University Secure Programming Group (OUSPG) co-developed and
subsequently used the PROTOS LDAPv3 test suite to study several
implementations of the LDAP protocol.
The PROTOS LDAPv3 test suite is divided into two main sections:
the "Encoding" section, which tests an LDAP server's response to
packets that violate the Basic Encoding Rules (BER), and the
"Application"
section, which tests an LDAP server's response to packets that
trigger
LDAP-specific application anomalies. Each section is further divided
into "groups" that collectively exercise a particular encoding or
application feature. Finally, each group contains one or more "test
cases," which represent the network packets that are used to test
individual exceptional conditions.
By applying the PROTOS LDAPv3 test suite to a variety of popular
LDAP-enabled products, the OUSPG revealed the following
vulnerabilities:
VU#276944 - iPlanet Directory Server contains multiple
vulnerabilities
in LDAP handling code
The iPlanet Directory Server contains multiple vulnerabilities
in the code that processes LDAP requests.
In the encoding section of the test suite, this product had an
indeterminate number of failures in the group that tests
invalid BER length of length fields.
In the application section of the test suite, this product
failed four groups and had inconclusive results for an
additional five groups. The four failed groups indicate the
presence of buffer
overflow vulnerabilities. For the inconclusive groups, the
product
exhibited suspicious behavior while testing for format string
vulnerabilities.
VU#505564 - IBM SecureWay Directory is vulnerable to
denial-of-service
attacks via LDAP handling code
The IBM SecureWay Directory server contains one or more
vulnerabilities in the code that processes LDAP requests. These
vulnerabilities were discovered independently by IBM using the
PROTOS LDAPv3 test suite. The CERT/CC is not currently aware of
the
nature of these vulnerabilities.
VU#583184 - Lotus Domino R5 Server Family contains multiple
vulnerabilities in LDAP handling code
The Lotus Domino R5 Server Family (including the Enterprise,
Application, and Mail servers) contains multiple vulnerabilities
in
the code that processes LDAP requests.
In the encoding section of the test suite, this product failed 1
of
77 groups. The failed group tests a server's response to
miscellaneous packets with semi-valid BER encodings.
In the application section of the test suite, this product
failed 23 of 77 groups. These results suggest that both buffer
overflow and format string vulnerabilities are likely to be
present in a variety of application components.
VU#688960 - Teamware Office contains multiple vulnerabilities in
LDAP handling code
The Teamware Office suite is packaged with a combination
X.500/LDAP
server that provides directory services. Multiple versions of the
Office product contain vulnerabilities that cause the LDAP server
to crash in response to traffic sent by the PROTOS LDAPv3 test
suite.
In the encoding section of the test suite, this product failed
9 of
16 groups involving invalid encodings for several BER object
types.
In the application section of the test suite, this product
failed 4
of 32 groups. The remaining 45 groups were not exercised during
the
test runs. The four failed groups indicate the presence of buffer
overflow vulnerabilities.
VU#717380 - Potential vulnerabilities in Qualcomm Eudora WorldMail
Server LDAP handling code
While investigating the vulnerabilities reported by OUSPG, it
was brought to our attention that the Eudora WorldMail Server
may contain vulnerabilities that can be triggered via the
PROTOS test
suite. The CERT/CC has reported this possibility to Qualcomm and
an
investigation is pending.
VU#763400 - Microsoft Exchange 5.5 LDAP Service is vulnerable to
denial-of-service attacks
The Microsoft Exchange 5.5 LDAP Service contains a
vulnerability
that causes the LDAP server to freeze in response to malformed
LDAP
requests generated by the PROTOS test suite. This only affects
the
LDAP service; all other Exchange services, including mail
handling,
continue normally.
Although this product was not included in OUSPG's initial
testing,
subsequent informal testing revealed that the LDAP service of the
Microsoft Exchange 5.5 became unresponsive while processing test
cases containing exceptional BER encodings for the LDAP filter
type
field.
VU#765256 - Network Associates PGP Keyserver contains multiple
vulnerabilities in LDAP handling code
The Network Associates PGP Keyserver 7.0 contains multiple
vulnerabilities in the code that processes LDAP requests.
In the encoding section of the test suite, this product failed
12 of 16 groups.
In the application section of the test suite, this product failed
1
of 77 groups. The failed group focused on out-of-bounds integer
values for the messageID parameter. Due to a peculiarity of this
test group, this failure may actually represent an encoding
failure.
VU#869184 - Oracle 8i Enterprise Edition contains multiple
vulnerabilities in LDAP handling code
The Oracle 8i Enterprise Edition server contains multiple
vulnerabilities in the code used to process LDAP requests.
In the encoding section of the test suite, this product failed
an indeterminate number of test cases in the group that tests
a server's response to invalid encodings of BER
OBJECT-IDENTIFIER values.
In the application section of the test suite, this product
failed 46 of 77 groups. These results suggest that both buffer
overflow and format string vulnerabilities are likely to be
present in a variety of application components.
VU#935800 - Multiple versions of OpenLDAP are vulnerable to
denial-of-service attacks
There are multiple vulnerabilities in the OpenLDAP
implementations
of the LDAP protocol. These vulnerabilities exist in the code
that
translates network datagrams into application-specific
information.
In the encoding section of the test suite, this product failed
the
group that tests the handling of invalid BER length of length
fields.
In the application section of the test suite, this product
passed all 6685 test cases.
Additional Information
For the most up-to-date information regarding these
vulnerabilities, please visit the CERT/CC Vulnerability Notes
Database at:
http://www.kb.cert.org/vuls/
Please note that the test results summarized above should not be
interpreted as a statement of overall software quality. However,
the CERT/CC does believe that these results are useful in
describing the characteristics of these vulnerabilities. For
example, an application that fails multiple groups indicates that
problems exist in different areas of the code, rather than in a
specific code segment.
II. Impact
VU#276944 - iPlanet Directory Server contains multiple
vulnerabilities
in LDAP handling code
One or more of these vulnerabilities allow a remote attacker to
execute arbitrary code with the privileges of the Directory
Server.
The server typically runs with system privileges. At least one of
these vulnerabilities has been successfully exploited in a
laboratory environment under Windows NT 4.0, but they may affect
other platforms as well.
VU#505564 - IBM SecureWay Directory is vulnerable to
denial-of-service
attacks via LDAP handling code
These vulnerabilities allow a remote attacker to crash
affected SecureWay Directory servers, resulting in a
denial-of-service condition. It is not known at this time
whether these vulnerabilities will allow a remote attacker to
execute arbitrary code. These vulnerabilities exist on the
Solaris and Windows 2000 platforms but are not present under
Windows NT, AIX, and AIX with SSL.
VU#583184 - Lotus Domino R5 Server Family contains multiple
vulnerabilities in LDAP handling code
One or more of these vulnerabilities allow a remote attacker to
execute arbitrary code with the privileges of the Domino
server. The server typically runs with system privileges. At
least
one of these vulnerabilities has been successfully exploited in a
laboratory environment.
VU#688960 - Teamware Office contains multiple vulnerabilities in
LDAP handling code
These vulnerabilities allow a remote attacker to crash affected
Teamware LDAP servers, resulting in a denial-of-service
condition.
They may also allow a remote attacker to execute arbitrary code
with the privileges of the Teamware server. The server typically
runs with system privileges.
VU#717380 - Potential vulnerabilities in Qualcomm Eudora WorldMail
Server LDAP handling code
The CERT/CC has not yet determined the impact of this
vulnerability.
VU#763400 - Microsoft Exchange 5.5 LDAP Service is vulnerable to
denial-of-service attacks
This vulnerability allows a remote attacker to crash the LDAP
component of vulnerable Exchange 5.5 servers, resulting in a
denial-of-service condition within the LDAP component.
VU#765256 - Network Associates PGP Keyserver contains multiple
vulnerabilities in LDAP handling code
One or more of these vulnerabilities allow a remote attacker
to execute arbitrary code with the privileges of the
Keyserver. The
server typically runs with system privileges. At least one of
these
vulnerabilities has been successfully exploited in a laboratory
environment.
VU#869184 - Oracle 8i Enterprise Edition contains multiple
vulnerabilities in LDAP handling code
One or more of these vulnerabilities allow a remote attacker to
execute arbitrary code with the privileges of the Oracle
server. The server typically runs with system privileges. At
least
one of these vulnerabilities has been successfully exploited in a
laboratory environment.
VU#935800 - Multiple versions of OpenLDAP are vulnerable to
denial-of-service attacks
These vulnerabilities allow a remote attacker to crash affected
OpenLDAP servers, resulting in a denial-of-service condition.
III. Solution
Apply a patch from your vendor
Appendix A contains information provided by vendors for this
advisory.
Please consult this appendix to determine if you need to contact your
vendor directly.
Block access to directory services at network perimeter
As a temporary measure, it is possible to limit the scope of these
vulnerabilities by blocking access to directory services at the
network perimeter. Please note that this workaround does not
protect vulnerable products from internal attacks.
ldap 389/tcp # Lightweight Directory Access Protocol
ldap 389/udp # Lightweight Directory Access Protocol
ldaps 636/tcp # ldap protocol over TLS/SSL (was sldap)
ldaps 636/udp # ldap protocol over TLS/SSL (was sldap)
Appendix A. - Vendor Information
This appendix contains information provided by vendors for this
advisory. As vendors report new information to the CERT/CC, we will
update this section and note the changes in our revision history. If
a
particular vendor is not listed below, we have not received their
comments.
IBM Corporation
IBM and Tivoli are currently investigating the details of the
vulnerabilities in the various versions of the SecureWay product
family.
Fixes are being implemented as these details become known.
Fixes will be posted to the download sites (IBM or Tivoli) for the
affected platform. See http://www-1.ibm.com/support under "Server
Downloads" or "Software Downloads" for links to the fix
distribution sites.
iPlanet E-Commerce Solutions
[CERT/CC Addendum: These vulnerabilities were originally discovered
in
Directory Server 5.0 Beta and were later found to exist in versions
up
to and including version 4.13. These vulnerabilities have been
addressed in the released version of Directory Server 5.0.]
Lotus Development Corporation
Lotus reproduced the problem as reported by OUSPG and documented it
in
SPR#DWUU4W6NC8.
Lotus considers security issues as top priority, so we acted
quickly to resolve the problem in a maintenance update to
Domino. It was addressed in Domino R5.0.7a, which was released on
May 18th, 2001. This release can be downloaded from Notes.net at
http://www.notes.net/qmrdown.nsf/qmrwelcome.
The fix is documented in the fix list at
http://www.notes.net/r5fixlist.nsf/Search!SearchView&Query=DWUU
4W6NC8
Microsoft Corporation
Microsoft is developing a hotfix for this issue which will be
available shortly.
Customers can obtain this hotfix by contacting Product Support
Services at no charge and asking for Q303448 and
Q303450. Information on contacting Microsoft Product Support
Services can be found at
http://www.microsoft.com/support/
Network Associates, Inc.
Network Associates has resolved these vulnerabilities in Hotfix 2
for
both Solaris and Windows NT. All Network Associates Enterprise
Support
customers have been notified and have been provided access to the
Hotfix.
This Hotfix can be downloaded at
http://www.pgp.com/downloads/default.asp
The OpenLDAP Project
[CERT/CC Addendum: To address these vulnerabilities, the OpenLDAP
Project has released OpenLDAP 1.2.12 for use in LDAPv2 environments
and OpenLDAP 2.0.8 for use in LDAPv3 environments. The CERT/CC
recommends that users of OpenLDAP contact their software vendor or
obtain the latest version, available at
http://www.openLDAP.org/software/download/.]
QUALCOMM Incorporated
The LDAP service in WorldMail may be vulnerable to this exploit,
but our tests so far have been inconclusive. At this time, we
strongly urge all WorldMail customers to ensure that the LDAP
service is not accessible from outside their organization nor by
untrusted users.
The Teamware Group
An issue has been discovered with Teamware Office Enterprise
Directory
(LDAP server) that shows a abnormal termination or loop when the LDAP
server encounters a maliciously or incorrectly created LDAP request
data.
If the maliciously formatted LDAP request data is requested, the
LDAP server may excessively copy the LDAP request data to the
stack area.
This overflow is likely to cause execution of malicious code. In
other
case, the LDAP server may go into abnormal termination or infinite
loop.
[CERT/CC Addendum: Teamware has provided additional documentation
of these issues in their "Teamware Solution Database," available
at http://support.teamw.com/Online/s_database1.shtml. Registered
users can find information on these vulnerabilities by searching
for document #010703-0000 for Windows NT or document #010703-0001
for Solaris.]
Appendix B. - Supplemental Information
The PROTOS Project
The PROTOS project is a research partnership between the University
of
Oulu and VTT Electronics, an independent research organization owned
by the Finnish government. The project studies methods by which
protocol implementations can be tested for information security
defects.
Although the vulnerabilities discussed in this advisory relate
specifically to the LDAP protocol, the methodology used to
research,
develop, and deploy the PROTOS LDAPv3 test suite can be applied to
any
communications protocol.
For more information on the PROTOS project and its collection of
test suites, please visit
http://www.ee.oulu.fi/research/ouspg/protos/
ASN.1 and the BER
Abstract Syntax Notation One (ASN.1) is a flexible notation that
allows one to define a variety data types. The Basic Encoding Rules
(BER) describe how to represent or encode the values of each ASN.1
type as a string of octets. This allow programmers to encode and
decode data for platform-independent transmission over a network.
References
The following is a list of URLs referenced in this advisory as well
as
other useful sources of information:
http://www.cert.org/advisories/CA-2001-18.html
http://www.ietf.org/rfc/rfc2116.txt
http://www.ietf.org/rfc/rfc2251.txt
http://www.ietf.org/rfc/rfc2252.txt
http://www.ietf.org/rfc/rfc2253.txt
http://www.ietf.org/rfc/rfc2254.txt
http://www.ietf.org/rfc/rfc2255.txt
http://www.ietf.org/rfc/rfc2256.txt
http://www.ee.oulu.fi/research/ouspg/protos/
http://www.ee.oulu.fi/research/ouspg/protos/testing/c06/ldapv3/
http://www.kb.cert.org/vuls/
http://www.kb.cert.org/vuls/id/276944
http://www.kb.cert.org/vuls/id/505564
http://www.kb.cert.org/vuls/id/583184
http://www.kb.cert.org/vuls/id/688960
http://www.kb.cert.org/vuls/id/717380
http://www.kb.cert.org/vuls/id/763400
http://www.kb.cert.org/vuls/id/765256
http://www.kb.cert.org/vuls/id/869184
http://www.kb.cert.org/vuls/id/935800
_________________________________________________________________
The CERT Coordination Center thanks the Oulu University Secure
Programming Group for reporting these vulnerabilities to us, for
their
detailed technical analyses, and for their assistance in preparing
this advisory. We also thank the many vendors who provided feedback
regarding their respective vulnerabilities.
_________________________________________________________________
Authors: Jeffrey P. Lanza and Cory F. Cohen. Feedback on this
advisory
is greatly appreciated.
______________________________________________________________________
This document is available from:
http://www.cert.org/advisories/CA-2001-18.html
______________________________________________________________________
CERT/CC Contact Information
Email: cert@cert.org
Phone: +1 412-268-7090 (24-hour hotline)
Fax: +1 412-268-6989
Postal address:
CERT Coordination Center
Software Engineering Institute
Carnegie Mellon University
Pittsburgh PA 15213-3890
U.S.A.
CERT personnel answer the hotline 08:00-17:00 EST(GMT-5) /
EDT(GMT-4) Monday through Friday; they are on call for emergencies
during other hours, on U.S. holidays, and on weekends.
Using encryption
We strongly urge you to encrypt sensitive information sent by
email. Our public PGP key is available from
http://www.cert.org/CERT_PGP.key
If you prefer to use DES, please call the CERT hotline for more
information.
Getting security information
CERT publications and other security information are available from
our web site
http://www.cert.org/
To subscribe to the CERT mailing list for advisories and
bulletins, send email to majordomo@cert.org. Please include in the
body of your message
subscribe cert-advisory
* "CERT" and "CERT Coordination Center" are registered in the U.S.
Patent and Trademark Office.
______________________________________________________________________
NO WARRANTY Any material furnished by Carnegie Mellon University
and the Software Engineering Institute is furnished on an "as is"
basis. Carnegie
Mellon University makes no warranties of any kind, either expressed
or
implied as to any matter including, but not limited to, warranty of
fitness for a particular purpose or merchantability, exclusivity or
results obtained from use of the material. Carnegie Mellon University
does not make any warranty of any kind with respect to freedom from
patent, trademark, or copyright infringement.
_________________________________________________________________
Conditions for use, disclaimers, and sponsorship information
Copyright 2001 Carnegie Mellon University.
Revision History
Jul 16, 2001: Initial release
-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 5.0i for non-commercial use
Charset: noconv
iQCVAwUBO1O5eQYcfu8gsZJZAQGupwQAikpVVn5wK0o9Kzdl3wjFf2jEhbyr3Ngz
ycfKTYp8GfaKvKf9HzM/861WBmAkRIkChM+t9mQZ2FuH6nNMzfYRputHb3MK5w18
8EOE/stQbV0kDgXxi078ELkvZy4tqrNhd7KXNtsFCPvwo7XTrJJFLTpCS5Nltheq
PaynurnhNrw=
=mEjW
-----END PGP SIGNATURE-----
(6759335) / <aleph1@securityfocus.com>/---(Ombruten)
Kommentar i text 6764969 av Lupe Christoph <lupe@lupe-christoph.de>