Arch Linux Security Advisory ASA-201509-4 ========================================= Severity: High Date : 2015-09-12 CVE-ID : CVE-2015-6908 Package : openldap Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package openldap before version 2.4.42-2 is vulnerable to a remote denial of service. Resolution ========== Upgrade to 2.4.42-2. # pacman -Syu "openldap>=2.4.42-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== By sending a crafted packet, an attacker can cause the OpenLDAP daemon to crash with a SIGABRT. This is due to an assert() call within the ber_get_next method (io.c line 682) that is hit when decoding tampered BER data. The following proof of concept exploit can be used to trigger the condition: # echo "/4SEhISEd4MKYj5ZMgAAAC8=" | base64 -d | nc -v 127.0.0.1 389 The above causes slapd to abort as follows when running with '-d3', however it should be noted that this will crash the server even when running in daemon mode. Impact ====== A remote attacker is able to send specially crafted packets that cause the OpenLDAP server to crash, leading to denial of service. References ========== http://www.openldap.org/its/index.cgi/Software%20Bugs?id=8240 http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=commitdiff;h=6fe51... https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6908 https://bugs.archlinux.org/task/46265