Updated openldap packages are available which fix a number of local and remote buffer overflows in libldap, and in the slapd and slurpd servers, as well as fixing potential issues stemming from using user-specified LDAP configuration files.
OpenLDAP is a suite of LDAP (Lightweight Directory Access Protocol) applications and development tools. LDAP is a set of protocols for accessing directory services. In an audit of OpenLDAP by SuSE, a number of potential security issues were found: When reading configuration files, libldap reads the current user's .ldaprc file -- even in applications running with elevated privileges. Slurpd overflows an internal buffer if the command line argument used with the -t or -r flags is too long, or if the name of a file for which it attempts to create an advisory lock is too long. When parsing filters, the getfilter family of functions from libldap could be made to overflow an internal buffer by supplying a carefully crafted ldapfilter.conf file. When processing LDAP entry display templates, libldap could be made to overflow an internal buffer by supplying a properly crafted ldaptemplates.conf file. When parsing an access control list, slapd could be made to overflow an internal buffer. When constructing the name of the file used for logging rejected replication requests, slapd overflows an internal buffer if the size of the generated name is too large, and could be tricked into destroying the contents of any file owned by the ldap user due to a race condition in the subsequent creation of the log file. Red Hat Linux users who use LDAP are advised to install the updated openldap packages which are not vulnerable to these issues.