|
 |
dc8c34 |
From 4062dd1bd7c34b04208a51181af5573b4e257f9d Mon Sep 17 00:00:00 2001
|
|
|
dc8c34 |
From: Noriko Hosoi <nhosoi@redhat.com>
|
|
|
dc8c34 |
Date: Thu, 28 Mar 2013 11:08:18 -0700
|
|
|
dc8c34 |
Subject: [PATCH 42/42] Ticket #47308 - unintended information exposure when
|
|
|
dc8c34 |
anonymous access is set to rootdse
|
|
|
dc8c34 |
|
|
|
dc8c34 |
Bug description: The actual search base was not being checked
|
|
|
dc8c34 |
at all. There was a check for the search base when this feature
|
|
|
dc8c34 |
was initially implemented, but it was inadvertently removed when
|
|
|
dc8c34 |
changes were made to reduce the DN normalization throughout the
|
|
|
dc8c34 |
source tree (commit f6397113666f06848412bb12f754f04258cfa5fa).
|
|
|
dc8c34 |
|
|
|
dc8c34 |
Fix description: This patch adds the search base check back.
|
|
|
dc8c34 |
|
|
|
dc8c34 |
Note: CVE-2013-1897
|
|
|
dc8c34 |
|
|
|
dc8c34 |
https://fedorahosted.org/389/ticket/47308
|
|
|
dc8c34 |
|
|
|
dc8c34 |
Reviewed by Rich, Noriko and Mark.
|
|
|
dc8c34 |
(cherry picked from commit 4b2d700b77c1d4a0a2ad6592e2296068a200cbdd)
|
|
|
dc8c34 |
---
|
|
|
dc8c34 |
ldap/servers/slapd/search.c | 2 +-
|
|
|
dc8c34 |
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
dc8c34 |
|
|
|
dc8c34 |
diff --git a/ldap/servers/slapd/search.c b/ldap/servers/slapd/search.c
|
|
|
dc8c34 |
index c3d51d6..7719727 100644
|
|
|
dc8c34 |
--- a/ldap/servers/slapd/search.c
|
|
|
dc8c34 |
+++ b/ldap/servers/slapd/search.c
|
|
|
dc8c34 |
@@ -141,7 +141,7 @@ do_search( Slapi_PBlock *pb )
|
|
|
dc8c34 |
/* If anonymous access is only allowed for searching the root DSE,
|
|
|
dc8c34 |
* we need to reject any other anonymous search attempts. */
|
|
|
dc8c34 |
if ((slapi_sdn_get_dn(&(operation->o_sdn)) == NULL) &&
|
|
|
dc8c34 |
- (scope != LDAP_SCOPE_BASE) &&
|
|
|
dc8c34 |
+ ((rawbase && strlen(rawbase) > 0) || (scope != LDAP_SCOPE_BASE)) &&
|
|
|
dc8c34 |
(config_get_anon_access_switch() == SLAPD_ANON_ACCESS_ROOTDSE)) {
|
|
|
dc8c34 |
op_shared_log_error_access(pb, "SRCH", rawbase?rawbase:"",
|
|
|
dc8c34 |
"anonymous search not allowed");
|
|
|
dc8c34 |
--
|
|
|
dc8c34 |
1.8.1.4
|
|
|
dc8c34 |
|