CVE-2020-36223
📋 TL;DR
This vulnerability in OpenLDAP's slapd daemon allows attackers to trigger a crash through malformed Values Return Filter control requests, causing denial of service. The flaw involves double free and out-of-bounds read conditions that can be exploited remotely. Organizations running OpenLDAP servers are affected.
💻 Affected Systems
- OpenLDAP
📦 What is this software?
Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →Openldap by Openldap
⚠️ Risk & Real-World Impact
Worst Case
Complete service outage of LDAP directory services, disrupting authentication, authorization, and directory lookups for dependent applications and users.
Likely Case
Service disruption requiring manual restart of slapd, potentially causing authentication failures and application downtime until service is restored.
If Mitigated
Minimal impact with proper network segmentation and monitoring allowing quick detection and recovery from service interruptions.
🎯 Exploit Status
Proof-of-concept code has been published in security advisories. Exploitation requires sending specially crafted LDAP requests to the slapd service.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: OpenLDAP 2.4.57 and later
Vendor Advisory: https://bugs.openldap.org/show_bug.cgi?id=9408
Restart Required: Yes
Instructions:
1. Download OpenLDAP 2.4.57 or later from openldap.org. 2. Stop slapd service. 3. Install updated version. 4. Restart slapd service. 5. Verify service is running and responding.
🔧 Temporary Workarounds
Disable Values Return Filter Control
linuxTemporarily disable the vulnerable control to prevent exploitation while planning upgrade.
Edit slapd.conf or slapd.d configuration and remove or comment out 'olcValuesReturnFilter' settings
Restart slapd: systemctl restart slapd
Network Access Control
linuxRestrict access to LDAP ports (389, 636) to trusted networks only.
iptables -A INPUT -p tcp --dport 389 -s TRUSTED_NETWORK -j ACCEPT
iptables -A INPUT -p tcp --dport 389 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to limit LDAP access to essential systems only
- Deploy intrusion detection systems to monitor for malformed LDAP requests and restart services automatically if crashes are detected
🔍 How to Verify
Check if Vulnerable:
Check OpenLDAP version: slapd -VV 2>&1 | grep 'OpenLDAP' and compare to 2.4.57. Versions below 2.4.57 are vulnerable.Check Version:
slapd -VV 2>&1 | grep 'OpenLDAP'Verify Fix Applied:
After patching, verify version is 2.4.57 or higher and test LDAP functionality with standard queries.📡 Detection & Monitoring
Log Indicators:
- slapd crash logs in systemd journal or syslog
- Unexpected slapd restarts
- Error messages related to 'Values Return Filter' or memory corruption
Network Indicators:
- Unusual LDAP request patterns from single sources
- Multiple connection attempts followed by service unavailability
SIEM Query:
source="*slapd*" AND ("crash" OR "segmentation fault" OR "double free" OR "out-of-bounds")🔗 References
- http://seclists.org/fulldisclosure/2021/May/64
- http://seclists.org/fulldisclosure/2021/May/65
- http://seclists.org/fulldisclosure/2021/May/70
- https://bugs.openldap.org/show_bug.cgi?id=9408
- https://git.openldap.org/openldap/openldap/-/commit/21981053a1195ae1555e23df4d9ac68d34ede9dd
- https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57
- https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
- https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html
- https://security.netapp.com/advisory/ntap-20210226-0002/
- https://support.apple.com/kb/HT212529
- https://support.apple.com/kb/HT212530
- https://support.apple.com/kb/HT212531
- https://www.debian.org/security/2021/dsa-4845
- http://seclists.org/fulldisclosure/2021/May/64
- http://seclists.org/fulldisclosure/2021/May/65
- http://seclists.org/fulldisclosure/2021/May/70
- https://bugs.openldap.org/show_bug.cgi?id=9408
- https://git.openldap.org/openldap/openldap/-/commit/21981053a1195ae1555e23df4d9ac68d34ede9dd
- https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57
- https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
- https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html
- https://security.netapp.com/advisory/ntap-20210226-0002/
- https://support.apple.com/kb/HT212529
- https://support.apple.com/kb/HT212530
- https://support.apple.com/kb/HT212531
- https://www.debian.org/security/2021/dsa-4845
