Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.
Bug 1109334 - 389 Server crashes if uniqueMember is invalid syntax and memberOf plugin is enabled.
389 Server crashes if uniqueMember is invalid syntax and memberOf plugin is e...
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: 389-ds-base (Show other bugs)
7.1
Unspecified Unspecified
medium Severity unspecified
: rc
: ---
Assigned To: Noriko Hosoi
Viktor Ashirov
:
Depends On: 1109333
Blocks:
  Show dependency treegraph
 
Reported: 2014-06-13 13:16 EDT by Noriko Hosoi
Modified: 2015-03-05 04:35 EST (History)
3 users (show)

See Also:
Fixed In Version: 389-ds-base-1.3.3.1-1.el7
Doc Type: Bug Fix
Doc Text:
Cause: MemberOf plugin code assumes the DN value has the correct syntax, and does not check the normalized value of that DN. Consequence: This leads to dereferencing a NULL pointer and crash. Fix: Check the normalized value, and log a proper error. Result: Invalid DN does not cause the crash and it is logged in the error log.
Story Points: ---
Clone Of: 1109333
Environment:
Last Closed: 2015-03-05 04:35:17 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2015:0416 normal SHIPPED_LIVE Important: 389-ds-base security, bug fix, and enhancement update 2015-03-05 09:26:33 EST

  None (edit)
Description Noriko Hosoi 2014-06-13 13:16:06 EDT
+++ This bug was initially created as a clone of Bug #1109333 +++

This bug is created as a clone of upstream ticket:
https://fedorahosted.org/389/ticket/47793

Attempting to add a uniqueMember to a group of type groupOfUniqueNames crashes the server if syntax checking is off.

Steps to recreate:
1. Enable memberofplugin with memberofgroupattr=uniqueMember and memberofattr=memberOf.  (Requires server restart)
2. Disable syntax checking: in cn=cn=config, attribute nsslapd-syntaxcheck=off
3. In any groupOfUniqueName group, add an invalid uniqueMember such as cn=test,null,dc=will,dc=crash
Comment 1 Noriko Hosoi 2014-07-09 17:40:00 EDT
Steps to verify:
Description in https://fedorahosted.org/389/ticket/47793
Comment 3 Viktor Ashirov 2014-11-21 11:13:30 EST
$ rpm -qa | grep 389
389-ds-base-1.3.3.1-9.el7.x86_64
389-ds-base-debuginfo-1.3.3.1-9.el7.x86_64
389-ds-base-libs-1.3.3.1-9.el7.x86_64

$ ldapmodify -D 'cn=Directory Manager' -w Secret123  -H ldap://localhost:389  << EOF
> dn: cn=config
> changetype: modify
> replace: nsslapd-syntaxcheck
> nsslapd-syntaxcheck: off
> -
> 
> dn: cn=MemberOf Plugin,cn=plugins,cn=config
> changetype: modify
> replace: memberofgroupattr
> memberofgroupattr: member
> memberofgroupattr: uniqueMember
> -
> replace: nsslapd-pluginEnabled
> nsslapd-pluginEnabled: on
> -
> EOF
modifying entry "cn=config"

modifying entry "cn=MemberOf Plugin,cn=plugins,cn=config"

$ ldapadd -D 'cn=Directory Manager' -w Secret123  -H ldap://localhost:389  << EOF
> dn: cn=memberofgroup,ou=Groups,dc=example,dc=com
> objectClass: groupofuniquenames
> objectClass: top
> cn: memberofgroup
> EOF
adding new entry "cn=memberofgroup,ou=Groups,dc=example,dc=com"

$ ldapmodify -D 'cn=Directory Manager' -w Secret123  -H ldap://localhost:389  << EOF
> dn: cn=memberofgroup,ou=Groups,dc=example,dc=com
> changetype: modify
> add: uniqueMember
> uniqueMember: cn=test,null,dc=will,dc=crash
> -
> EOF
modifying entry "cn=memberofgroup,ou=Groups,dc=example,dc=com"

$ pgrep ns-slapd
7723

Server keeps running. On affected version of 389-ds-base ns-slapd would crash. 
Hence marking as verified.
Comment 5 errata-xmlrpc 2015-03-05 04:35:17 EST
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2015-0416.html

Note You need to log in before you can comment on or make changes to this bug.