[Full-disclosure] [MU-200606-02] Apple Open Directory Pre-Authentication Denial of Service

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Apple Open Directory Pre-Authentication Denial of Service [MU-200606-02]
June 27, 2006

http://labs.musecurity.com/advisories.html

Affected Product/Versions:

OSX 10.4.4 through 10.4.6

Product Overview:

http://www.apple.com/server/macosx/features/opendirectory.html

"Apple has made it easy to integrate Mac OS X and Mac OS X Server systems into
virtually any managed network environment thanks to Open Directory, Apples
standards-based directory and network authentication services architecture.

Open Directory relies on powerful open source technologies, like Open LDAP and
Kerberos, for seamless interoperability with other standards-based LDAP
servers."

Vulnerability Details:

A denial of service condition exists in slapd (OpenLDAP-2.2.19) during the
anonymous bind operation. By sending a malformed ldap-bind message, the slapd
server can be forced to abort with the following assertion:

/slapd/connection.c:1137: failed assertion `0'

No credentials are required to trigger this denial of service.

Vendor Response / Solution:

All users of this service are recommended to upgrade to OSX 10.4.7 which fixes
these problems.

Hotfix solution to this advisory:

http://docs.info.apple.com/article.html?artnum=61798

Mu Security would like to thank the Apple security team in advance for timely
remediation of these vulnerabilities.

History:

03/13/06 - First contact with vendor
04/07/06 - Vendor acknowledges vulnerability
06/27/06 - Advisory released

Credit:

This vulnerability was discovered by the Mu Security research team.

http://labs.musecurity.com/pgpkey.txt

Mu Security offers a new class of security analysis system, delivering a
rigorous and streamlined methodology for verifying the robustness and security
readiness of any IP-based product or application. Founded by the pioneers of
intrusion detection and prevention technology, Mu Security is backed by
preeminent venture capital firms that include Accel Partners, Benchmark
Capital and DAG Ventures. The company is headquartered in Sunnyvale, CA. For
more information, visit the companys website at http://www.musecurity.com.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (Darwin)

iD8DBQFEorYcMl+docYeP+YRAvvoAJ41/zNqW86hsM3Nwe4VocGqXa7s1gCfXdzI
3N9yx/H/wcvzq49LLFvEZWQ=
=tRGR
-----END PGP SIGNATURE-----

---

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/