Description

A flaw was found in the `ipa-enrollment` SLAPI plugin. A remote authenticated client can exploit a null pointer dereference vulnerability by sending a malformed Lightweight Directory Access Protocol (LDAP) extended operation. By omitting the request value for the `JOIN_OID` in the `ipa-enrollment` extended operation, an attacker can trigger a server crash, potentially causing a denial of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-20T11:16:21.813Z",
  "pubdate": "2026-08-20T11:16:21.813Z",
  "executiveSummary": "A null pointer dereference vulnerability exists within the ipa-enrollment SLAPI plugin, impacting Lightweight Directory Access Protocol (LDAP) services that utilize this component. The flaw allows a remote authenticated client to trigger a server crash, resulting in a denial of service (DoS) condition. The root cause lies in the improper handling of malformed LDAP extended operations specifically when the request value for the JOIN_OID is omitted. Attack requirements mandate that the adversary possesses remote authenticated access to the target system. Upon successful exploitation, the service becomes unresponsive, impacting availability without directly allowing remote code execution or unauthorized data exposure based on the provided data. Risk implications are centered on service disruption and availability degradation in environments running the vulnerable ipa-enrollment SLAPI plugin.",
  "technicalDetails": "The vulnerability resides in the ipa-enrollment SLAPI plugin, which processes LDAP extended operations. The vulnerable component fails to adequately validate input parameters associated with incoming LDAP extended operations, specifically regarding the handling of the JOIN_OID. When a remote authenticated client crafts and transmits a malformed LDAP extended operation that omits the request value for the JOIN_OID, the internal parsing logic attempts to reference a memory address that was never allocated or was explicitly initialized to NULL. Consequently, dereferencing this null pointer triggers an unhandled segmentation fault, causing the directory server process hosting the SLAPI plugin to crash abruptly. The attack vector is network-based, requiring the attacker to establish an authenticated session with the LDAP server. No specific elevated privileges are mentioned beyond remote authentication, meaning standard user credentials may suffice if they have permission to issue the malformed extended operation. The payload behavior consists of an intentionally malformed request structure lacking the expected request value fields. The post-exploitation impact is strictly confined to a denial of service through application-level crashing, as the server process terminates immediately upon processing the invalid pointer dereference."
}