Two vulnerabilities have been discovered in OpenLDAP, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially compromise a vulnerable system.

1) The "slap_modrdn2mods()" function in servers/slapd/modrdn.c does not check the return value of a call to "smr_normalize()". This can be exploited to free an uninitialised pointer and corrupt memory via an LDAP "modrdn" request containing a specially crafted "rdn" string.

2) An error exists in the processing of LDAP "modrdn" requests, which can be exploited to cause a NULL pointer dereference error in "IA5StringNormalize()" in servers/slapd/schema_init.c and crash the service via a specially crafted "rdn" string.

The vulnerabilities are confirmed in version 2.4.22. Prior versions may also be affected.

Solution
Update to version 2.4.23.

Provided and/or discovered by
Ilkka Mattila and Tuomas Salomäki using the Codenomicon LDAPv3 test suite.

Changelog
Further details available in Customer Area

Original Advisory
http://www.openldap.org/its/index.cgi/Software%20Bugs?id=6570

Technical Analysis
Further details available in Customer Area

Deep Links
Links available in Customer Area