Bug 842466 - (CVE-2012-3429) CVE-2012-3429 bind-dyndb-ldap: named DoS via DNS query with $ in name
CVE-2012-3429 bind-dyndb-ldap: named DoS via DNS query with $ in name
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
high Severity high
: ---
: ---
Assigned To: Red Hat Product Security
impact=important,public=20120801,repo...
: Security
Depends On: 841900 843538 845038
Blocks: 842467
  Show dependency treegraph
 
Reported: 2012-07-23 19:29 EDT by Vincent Danen
Modified: 2015-11-24 10:08 EST (History)
5 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-08-03 04:42:55 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Description Vincent Danen 2012-07-23 19:29:32 EDT
A denial of service flaw was found in the way the bind-dyndb-ldap, a
dynamic LDAP back-end plug-in for BIND, performed DN escaping for LDAP queries.  A DNS request containing a specially-crafted name (such as one containing the "$" character) from a domain stored in an LDAP back-end could cause named to exit unexpectedly because of the failed assertion.

This issue was introduced in the following commit that introduced DN escaping, partially in response to CVE-2012-2134 (bug #815846):

http://git.fedorahosted.org/git?p=bind-dyndb-ldap.git;a=commitdiff;h=3d43fd66aa68ef275855391a94e47e9d2f30309d

In Red Hat Enterprise Linux 6, this problem was introduced via bind-dyndb-ldap erratum RHBA-2012:0837 released as part of Red Hat Enterprise Linux 6.3:

https://rhn.redhat.com/errata/RHBA-2012-0837.html

Note that bind-dyndb-ldap packages from RHSA-2012:0683 are not affected by this issue, as a different fix was used there to address CVE-2012-2134.  DN escaping was only introduced later via the mentioned RHBA-2012:0837.

Acknowledgment:

Red Hat would like to thank Sigbjorn Lie of the Atea Norway for reporting this issue.
Comment 6 Tomas Hoger 2012-08-01 10:47:52 EDT
Created bind-dyndb-ldap tracking bugs for this issue

Affects: fedora-all [bug 845038]
Comment 7 errata-xmlrpc 2012-08-02 20:16:17 EDT
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2012:1139 https://rhn.redhat.com/errata/RHSA-2012-1139.html
Comment 8 Fedora Update System 2012-08-17 01:52:44 EDT
bind-dyndb-ldap-1.1.0-0.14.rc1.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 9 Fedora Update System 2012-08-17 01:54:11 EDT
bind-dyndb-ldap-1.1.0-0.14.rc1.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 10 Petr Spacek 2012-09-14 06:38:45 EDT
The flaw mentioned in this bug manifests itself with following error message (it is written to /var/log/messages usually):

Jul 30 15:44:23 nightcrawler named[31694]: ldap_convert.c:253: REQUIRE(dns_str_len > dns_idx + 3) failed, back trace
Jul 30 15:44:23 nightcrawler named[31694]: #0 0xf0d401 in ??
Jul 30 15:44:23 nightcrawler named[31694]: #1 0x94ada4 in ??
Jul 30 15:44:23 nightcrawler named[31694]: #2 0x323db5 in ??
Jul 30 15:44:23 nightcrawler named[31694]: #3 0x324030 in ??
Jul 30 15:44:23 nightcrawler named[31694]: #4 0x329ff9 in ??
Jul 30 15:44:23 nightcrawler named[31694]: #5 0x3260e2 in ??
Jul 30 15:44:23 nightcrawler named[31694]: #6 0x656f2d in ??
Jul 30 15:44:23 nightcrawler named[31694]: #7 0xf1849f in ??
Jul 30 15:44:23 nightcrawler named[31694]: #8 0xf1ec15 in ??
Jul 30 15:44:23 nightcrawler named[31694]: #9 0xf029d8 in ??
Jul 30 15:44:23 nightcrawler named[31694]: #10 0x96e00b in ??
Jul 30 15:44:23 nightcrawler named[31694]: #11 0xadea49 in ??
Jul 30 15:44:23 nightcrawler named[31694]: #12 0x42fe1e in ??
Jul 30 15:44:23 nightcrawler named[31694]: exiting (due to assertion failure)

Note You need to log in before you can comment on or make changes to this bug.