From ea60248d99abb8fed9f7a2b1ab7325c5523b8562 Mon Sep 17 00:00:00 2001

From: Ludwig Krispenz <lkrispen@redhat.com>

Date: Mon, 3 Apr 2017 09:32:20 +0200

Subject: [PATCH] fix for cve 2017-2668 - simple return text if suffix not

 found

Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1436575

Signed-off-by: Mark Reynolds <mreynolds@redhat.com>

---

 ldap/servers/slapd/defbackend.c | 75 ++---------------------------------------

 1 file changed, 2 insertions(+), 73 deletions(-)

diff --git a/ldap/servers/slapd/defbackend.c b/ldap/servers/slapd/defbackend.c

index 6fd74a3..6cd2c04 100644

--- a/ldap/servers/slapd/defbackend.c

+++ b/ldap/servers/slapd/defbackend.c

@@ -166,50 +166,7 @@ defbackend_abandon( Slapi_PBlock *pb )

 }

-#define DEFBE_NO_SUCH_SUFFIX "No such suffix"

-/*

- * Generate a "No such suffix" return text

- * Example:

- *   cn=X,dc=bogus,dc=com ==> "No such suffix (dc=bogus,dc=com)" 

- *     if the last rdn starts with "dc=", print all last dc= rdn's.

- *   cn=X,cn=bogus ==> "No such suffix (cn=bogus)"

- *     otherwise, print the very last rdn.

- *   cn=X,z=bogus ==> "No such suffix (x=bogus)"

- *     it is true even if it is an invalid rdn.

- *   cn=X,bogus ==> "No such suffix (bogus)"

- *     another example of invalid rdn.

- */

-static void

-_defbackend_gen_returntext(char *buffer, size_t buflen, char **dns)

-{

-    int dnidx;

-    int sidx;

-    struct suffix_repeat {

-        char *suffix;

-        int size;

-    } candidates[] = {

-        {"dc=", 3}, /* dc could be repeated.  otherwise the last rdn is used. */

-        {NULL, 0}

-    };

-    PR_snprintf(buffer, buflen, "%s (", DEFBE_NO_SUCH_SUFFIX);

-    for (dnidx = 0; dns[dnidx]; dnidx++) ; /* finding the last */

-    dnidx--; /* last rdn */

-    for (sidx = 0; candidates[sidx].suffix; sidx++) {

-        if (!PL_strncasecmp(dns[dnidx], candidates[sidx].suffix, candidates[sidx].size)) {

-            while (!PL_strncasecmp(dns[--dnidx], candidates[sidx].suffix, candidates[sidx].size)) ;

-            PL_strcat(buffer, dns[++dnidx]); /* the first "dn=", e.g. */

-            for (++dnidx; dns[dnidx]; dnidx++) {

-                PL_strcat(buffer, ",");

-                PL_strcat(buffer, dns[dnidx]);

-            }

-            PL_strcat(buffer, ")");

-            return; /* finished the task */

-        }

-    }

-    PL_strcat(buffer, dns[dnidx]);

-    PL_strcat(buffer, ")");

-    return;

-}

+#define DEFBE_NO_SUCH_SUFFIX "No suffix for bind dn found"

 static int

 defbackend_bind( Slapi_PBlock *pb )

@@ -231,36 +188,8 @@ defbackend_bind( Slapi_PBlock *pb )

         slapi_counter_increment(g_get_global_snmp_vars()->ops_tbl.dsAnonymousBinds);

         rc = SLAPI_BIND_ANONYMOUS;

     } else {

-        Slapi_DN *sdn = NULL;

-        char *suffix = NULL;

-        char **dns = NULL;

-        

-        if (pb->pb_op) {

-            sdn = operation_get_target_spec(pb->pb_op);

-            if (sdn) {

-                dns = slapi_ldap_explode_dn(slapi_sdn_get_dn(sdn), 0);

-                if (dns) {

-                    size_t dnlen = slapi_sdn_get_ndn_len(sdn);

-                    size_t len = dnlen + sizeof(DEFBE_NO_SUCH_SUFFIX) + 4;

-                    suffix = slapi_ch_malloc(len);

-                    if (dnlen) {

-                        _defbackend_gen_returntext(suffix, len, dns);

-                    } else {

-                        PR_snprintf(suffix, len, "%s", DEFBE_NO_SUCH_SUFFIX);

-                    }

-                }

-            }

-        }

-        if (suffix) {

-            slapi_pblock_set(pb, SLAPI_PB_RESULT_TEXT, suffix);

-        } else {

-            slapi_pblock_set(pb, SLAPI_PB_RESULT_TEXT, DEFBE_NO_SUCH_SUFFIX);

-        }

+        slapi_pblock_set(pb, SLAPI_PB_RESULT_TEXT, DEFBE_NO_SUCH_SUFFIX);

         send_ldap_result(pb, LDAP_INVALID_CREDENTIALS, NULL, "", 0, NULL);

-        if (dns) {

-            slapi_ldap_value_free(dns);

-        }

-        slapi_ch_free_string(&suffix);

         rc = SLAPI_BIND_FAIL;

     }

-- 

2.9.3