Red Hat Bugzilla – Bug 1109334
389 Server crashes if uniqueMember is invalid syntax and memberOf plugin is enabled.
Last modified: 2015-03-05 04:35:17 EST
+++ This bug was initially created as a clone of Bug #1109333 +++ This bug is created as a clone of upstream ticket: https://fedorahosted.org/389/ticket/47793 Attempting to add a uniqueMember to a group of type groupOfUniqueNames crashes the server if syntax checking is off. Steps to recreate: 1. Enable memberofplugin with memberofgroupattr=uniqueMember and memberofattr=memberOf. (Requires server restart) 2. Disable syntax checking: in cn=cn=config, attribute nsslapd-syntaxcheck=off 3. In any groupOfUniqueName group, add an invalid uniqueMember such as cn=test,null,dc=will,dc=crash
Steps to verify: Description in https://fedorahosted.org/389/ticket/47793
$ rpm -qa | grep 389 389-ds-base-1.3.3.1-9.el7.x86_64 389-ds-base-debuginfo-1.3.3.1-9.el7.x86_64 389-ds-base-libs-1.3.3.1-9.el7.x86_64 $ ldapmodify -D 'cn=Directory Manager' -w Secret123 -H ldap://localhost:389 << EOF > dn: cn=config > changetype: modify > replace: nsslapd-syntaxcheck > nsslapd-syntaxcheck: off > - > > dn: cn=MemberOf Plugin,cn=plugins,cn=config > changetype: modify > replace: memberofgroupattr > memberofgroupattr: member > memberofgroupattr: uniqueMember > - > replace: nsslapd-pluginEnabled > nsslapd-pluginEnabled: on > - > EOF modifying entry "cn=config" modifying entry "cn=MemberOf Plugin,cn=plugins,cn=config" $ ldapadd -D 'cn=Directory Manager' -w Secret123 -H ldap://localhost:389 << EOF > dn: cn=memberofgroup,ou=Groups,dc=example,dc=com > objectClass: groupofuniquenames > objectClass: top > cn: memberofgroup > EOF adding new entry "cn=memberofgroup,ou=Groups,dc=example,dc=com" $ ldapmodify -D 'cn=Directory Manager' -w Secret123 -H ldap://localhost:389 << EOF > dn: cn=memberofgroup,ou=Groups,dc=example,dc=com > changetype: modify > add: uniqueMember > uniqueMember: cn=test,null,dc=will,dc=crash > - > EOF modifying entry "cn=memberofgroup,ou=Groups,dc=example,dc=com" $ pgrep ns-slapd 7723 Server keeps running. On affected version of 389-ds-base ns-slapd would crash. Hence marking as verified.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHSA-2015-0416.html