Double-Free in 389 Directory Server

Executive Summary

This vulnerability is a double-free issue in the 389-ds-base LDAP server. The get_ldapmessage_controls_ext() function frees parsed controls without clearing a specific slot, causing a second free during teardown. An unauthenticated attacker can trigger this by sending a BIND request with a critical Session Tracking control, leading to heap corruption and potential denial of service.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor your 389-ds-base LDAP server logs for crashes or heap corruption errors during LDAP BIND requests. Check for unusual Session Tracking control usage by examining logs for requests containing OID 1.3.6.1.4.1.21008.108.63.1. Use tools like tcpdump or Wireshark to capture LDAP traffic and filter for BIND requests with critical Session Tracking controls.

Useful 0 Not Useful 0

Impact Analysis

The impact is denial of service due to server crashes from heap corruption. Exploitation requires a specific unauthenticated request with a critical Session Tracking control. On some systems, crashes may be absorbed silently, but others may experience reliable server failures. No information disclosure or privilege escalation has been demonstrated.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately restrict network access to LDAP ports (389/tcp, 636/tcp) using firewalls. Add the Session Tracking control OID 1.3.6.1.4.1.21008.108.63.1 to the ds-ignored-control-criticality configuration to ignore its criticality flag. Update 389-ds-base to version 3.2 or later where the fix is available.

Useful 0 Not Useful 0