OpenLDAP kbind authentication buffer overflow

[Solar Eclipse <solareclipse@xxxxxxxxxxxx>]

There is a remotely exploitable buffer overflow in the Kerberos KBIND
authentication code in the OpenLDAP slapd server.

The vulnerability is in the krbv4_ldap_auth function in
servers/slapd/kerberos.c. This function processes LDAP bind requests that
specify the LDAP_AUTH_KRBV41 authentication method. The cred variable contains
a pointer to the Kerberos authentication data sent by the client. The length of
the data is not checked before it is copied into a fixed size buffer on the
stack. Sending a bind request with more than 1250 bytes of credential data will
result in a buffer overflow. The vulnerable code is given below:

krbv4_ldap_auth(Backend *be, struct berval *cred, AUTH_DAT *ad)
{
    KTEXT_ST        k;
    KTEXT           ktxt = &k;
    char            instance[INST_SZ];
    int             err;

    Debug( LDAP_DEBUG_TRACE, "=> kerberosv4_ldap_auth\n", 0, 0, 0 );

    AC_MEMCPY( ktxt->dat, cred->bv_val, cred->bv_len );

There should be a length check before the call to memcpy.

The vulnerable code is enabled only when OpenLDAP is compiled with the
--enable-kbind option, which has been disabled by default since version 2.0.2
and was removed from the configure script in the 2.1 release. The chance of
finding a real system that is still vulnerable is minimal, however the code is
still available in the latest 2.4.3 version of OpenLDAP and can be enabled
manually as described in 
http://www.openldap.org/lists/openldap-software/200206/msg00371.html

For more details and exploit code see
http://www.phreedom.org/solar/exploits/openldap-kbind/


Solar Eclipse