389-ds-base

#49270 Crafted SSLv2 packet reliably crashes ns-slapd
Closed: wontfix Opened by qlsweany.

Closed: wontfix
Reopen Issue

Issue Description

I am able to reliably crash ns-slapd with a Qualys scan hitting port 636. The scan sends a crafted SSLv2 packet with no SSL handshake and causes a segfault. This problem began when updating to CentOS 6.9 / 389-ds-base-1.2.11.15-91.

Package Version and Platform

$ ns-slapd -v
389 Project
389-Directory/1.2.11.15 B2017.101.1452

$ rpm -qa | grep 389
389-admin-console-doc-1.1.8-1.el6.noarch
389-ds-base-libs-1.2.11.15-91.el6_9.x86_64
389-console-1.1.7-1.el6.noarch
389-admin-1.1.35-1.el6.x86_64
389-ds-base-debuginfo-1.2.11.15-91.el6_9.x86_64
389-ds-console-1.2.6-1.el6.noarch
389-dsgw-1.1.11-1.el6.x86_64
389-admin-console-1.1.8-1.el6.noarch
389-adminutil-1.1.19-1.el6.x86_64
389-ds-base-1.2.11.15-91.el6_9.x86_64
389-ds-console-doc-1.2.6-1.el6.noarch
389-ds-1.2.2-1.el6.noarch

$ cat /etc/redhat-release
CentOS release 6.9 (Final)

Steps to reproduce

  1. Start dirsrv service with SSL enabled
  2. Initiate Qualys scan / SSLv2 crafted packet replay
  3. Wait for segfault

Actual results

2017-05-19T07:59:28+00:00 hostname.local kernel: ns-slapd[22469]: segfault at 0 ip 00007f1d9aa7e6c1 sp 00007f1d783f8af8 error 6 in libc-2.12.so[7f1d9a9f5000+18a000]

Stack trace and screenshot of packet capture attached.

Expected results

No crash.

ldaps.png
stacktrace.1495496979.txt

https://bugzilla.redhat.com/show_bug.cgi?id=1435017
https://bugzilla.redhat.com/show_bug.cgi?id=1449161

This is an issue in NSS, not Directory Server. I'm closing it as these bugzillas are where the issue should be tracked.

Metadata Update from @firstyear:
- Custom field type adjusted to defect
- Issue close_status updated to: invalid
- Issue status updated to: Closed (was: Open)

389-ds-base is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in 389-ds-base's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/389ds/389-ds-base/issues/2329

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.

Metadata Update from @spichugi:
- Issue close_status updated to: wontfix (was: invalid)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.