Bug 842466 (CVE-2012-3429) - CVE-2012-3429 bind-dyndb-ldap: named DoS via DNS query with $ in name
Summary: CVE-2012-3429 bind-dyndb-ldap: named DoS via DNS query with $ in name
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2012-3429
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 841900 843538 845038
Blocks: 842467
TreeView+ depends on / blocked
 
Reported: 2012-07-23 23:29 UTC by Vincent Danen
Modified: 2019-09-29 12:54 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-08-03 08:42:55 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2012:1139 normal SHIPPED_LIVE Important: bind-dyndb-ldap security update 2012-08-03 04:14:56 UTC

Description Vincent Danen 2012-07-23 23:29:32 UTC
A denial of service flaw was found in the way the bind-dyndb-ldap, a
dynamic LDAP back-end plug-in for BIND, performed DN escaping for LDAP queries.  A DNS request containing a specially-crafted name (such as one containing the "$" character) from a domain stored in an LDAP back-end could cause named to exit unexpectedly because of the failed assertion.

This issue was introduced in the following commit that introduced DN escaping, partially in response to CVE-2012-2134 (bug #815846):

http://git.fedorahosted.org/git?p=bind-dyndb-ldap.git;a=commitdiff;h=3d43fd66aa68ef275855391a94e47e9d2f30309d

In Red Hat Enterprise Linux 6, this problem was introduced via bind-dyndb-ldap erratum RHBA-2012:0837 released as part of Red Hat Enterprise Linux 6.3:

https://rhn.redhat.com/errata/RHBA-2012-0837.html

Note that bind-dyndb-ldap packages from RHSA-2012:0683 are not affected by this issue, as a different fix was used there to address CVE-2012-2134.  DN escaping was only introduced later via the mentioned RHBA-2012:0837.

Acknowledgment:

Red Hat would like to thank Sigbjorn Lie of the Atea Norway for reporting this issue.

Comment 6 Tomas Hoger 2012-08-01 14:47:52 UTC
Created bind-dyndb-ldap tracking bugs for this issue

Affects: fedora-all [bug 845038]

Comment 7 errata-xmlrpc 2012-08-03 00:16:17 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2012:1139 https://rhn.redhat.com/errata/RHSA-2012-1139.html

Comment 8 Fedora Update System 2012-08-17 05:52:44 UTC
bind-dyndb-ldap-1.1.0-0.14.rc1.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 9 Fedora Update System 2012-08-17 05:54:11 UTC
bind-dyndb-ldap-1.1.0-0.14.rc1.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 10 Petr Spacek 2012-09-14 10:38:45 UTC
The flaw mentioned in this bug manifests itself with following error message (it is written to /var/log/messages usually):

Jul 30 15:44:23 nightcrawler named[31694]: ldap_convert.c:253: REQUIRE(dns_str_len > dns_idx + 3) failed, back trace
Jul 30 15:44:23 nightcrawler named[31694]: #0 0xf0d401 in ??
Jul 30 15:44:23 nightcrawler named[31694]: #1 0x94ada4 in ??
Jul 30 15:44:23 nightcrawler named[31694]: #2 0x323db5 in ??
Jul 30 15:44:23 nightcrawler named[31694]: #3 0x324030 in ??
Jul 30 15:44:23 nightcrawler named[31694]: #4 0x329ff9 in ??
Jul 30 15:44:23 nightcrawler named[31694]: #5 0x3260e2 in ??
Jul 30 15:44:23 nightcrawler named[31694]: #6 0x656f2d in ??
Jul 30 15:44:23 nightcrawler named[31694]: #7 0xf1849f in ??
Jul 30 15:44:23 nightcrawler named[31694]: #8 0xf1ec15 in ??
Jul 30 15:44:23 nightcrawler named[31694]: #9 0xf029d8 in ??
Jul 30 15:44:23 nightcrawler named[31694]: #10 0x96e00b in ??
Jul 30 15:44:23 nightcrawler named[31694]: #11 0xadea49 in ??
Jul 30 15:44:23 nightcrawler named[31694]: #12 0x42fe1e in ??
Jul 30 15:44:23 nightcrawler named[31694]: exiting (due to assertion failure)


Note You need to log in before you can comment on or make changes to this bug.