CVE-2020-36229
📋 TL;DR
This vulnerability in OpenLDAP's X.509 DN parsing can cause the slapd daemon to crash when processing specially crafted certificates, leading to denial of service. It affects OpenLDAP servers using X.509 certificate authentication. The flaw is triggered during DN parsing in the ad_keystring function.
💻 Affected Systems
- OpenLDAP
📦 What is this software?
Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →Openldap by Openldap
⚠️ Risk & Real-World Impact
Worst Case
Remote unauthenticated attackers could crash OpenLDAP slapd service, causing complete LDAP service outage and disrupting authentication/authorization systems.
Likely Case
Denial of service through slapd crash, requiring service restart to restore LDAP functionality.
If Mitigated
Minimal impact if proper network segmentation and certificate validation controls are in place.
🎯 Exploit Status
Exploitation requires sending specially crafted X.509 certificates to the OpenLDAP server. The vulnerability is in parsing logic, making reliable exploitation straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: OpenLDAP 2.4.57 and later
Vendor Advisory: https://bugs.openldap.org/show_bug.cgi?id=9425
Restart Required: Yes
Instructions:
1. Download OpenLDAP 2.4.57 or later from openldap.org. 2. Stop slapd service. 3. Install updated version. 4. Restart slapd service.
🔧 Temporary Workarounds
Disable X.509 certificate authentication
allTemporarily disable X.509 certificate authentication if not required
Edit slapd.conf or slapd.d configuration to remove TLSVerifyClient settings or set to 'never'
Network filtering
allBlock or filter incoming X.509 certificate traffic at network perimeter
🧯 If You Can't Patch
- Implement strict network segmentation to limit access to OpenLDAP servers
- Deploy WAF or IPS with rules to detect and block malicious certificate patterns
🔍 How to Verify
Check if Vulnerable:
Check OpenLDAP version: slapd -VV 2>&1 | grep -i 'openldap'Check Version:
slapd -VV 2>&1 | grep -i 'openldap'Verify Fix Applied:
Verify version is 2.4.57 or later and test with valid X.509 certificates📡 Detection & Monitoring
Log Indicators:
- slapd crash logs
- segmentation fault errors in system logs
- unexpected slapd restarts
Network Indicators:
- Unusual X.509 certificate traffic to LDAP ports
- Multiple connection attempts with malformed certificates
SIEM Query:
source="*slapd*" AND ("segmentation fault" OR "crash" OR "abort")🔗 References
- http://seclists.org/fulldisclosure/2021/May/64
- http://seclists.org/fulldisclosure/2021/May/65
- http://seclists.org/fulldisclosure/2021/May/70
- https://bugs.openldap.org/show_bug.cgi?id=9425
- https://git.openldap.org/openldap/openldap/-/commit/4bdfffd2889c0c5cdf58bebafbdc8fce4bb2bff0
- https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57
- https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
- https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html
- https://security.netapp.com/advisory/ntap-20210226-0002/
- https://support.apple.com/kb/HT212529
- https://support.apple.com/kb/HT212530
- https://support.apple.com/kb/HT212531
- https://www.debian.org/security/2021/dsa-4845
- http://seclists.org/fulldisclosure/2021/May/64
- http://seclists.org/fulldisclosure/2021/May/65
- http://seclists.org/fulldisclosure/2021/May/70
- https://bugs.openldap.org/show_bug.cgi?id=9425
- https://git.openldap.org/openldap/openldap/-/commit/4bdfffd2889c0c5cdf58bebafbdc8fce4bb2bff0
- https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57
- https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
- https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html
- https://security.netapp.com/advisory/ntap-20210226-0002/
- https://support.apple.com/kb/HT212529
- https://support.apple.com/kb/HT212530
- https://support.apple.com/kb/HT212531
- https://www.debian.org/security/2021/dsa-4845
