[jira] [Closed] (DIRAPI-439) Hostile server subschema bytecode is class-loaded and instantiated on the client

["Emmanuel Lécharny (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/DIRAPI-439?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Emmanuel Lécharny closed DIRAPI-439.
------------------------------------
    Resolution: Fixed

> Hostile server subschema bytecode is class-loaded and instantiated on the client
> --------------------------------------------------------------------------------
>
>                 Key: DIRAPI-439
>                 URL: https://issues.apache.org/jira/browse/DIRAPI-439
>             Project: Directory Client API
>          Issue Type: Bug
>    Affects Versions: 2.1.8
>            Reporter: Emmanuel Lécharny
>            Priority: Major
>             Fix For: 2.1.9
>
>
> A rogue/compromised *LDAP* server (or pre-*TLS* *MITM*) answers a client's _loadSchema()_ subschema search with '_syntaxCheckers_: 
> {code:java}
> ( 1.2.3.4 FQCN evil.Pwn BYTECODE <base64 of a class whose static{} runs Runtime.exec> X-SCHEMA "other" )
> {code}
> _DefaultSchemaLoader_ parses it, _SchemaEntityFactory_ defines the class via _AttributeClassLoader_ and instantiates it — attacker code executes in the client *JVM* with the application's privileges.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For additional commands, e-mail: dev-help@directory.apache.org