servers/slapd/back-mdb/search.c in OpenLDAP through 2.4.44 is prone to a double free vulnerability. A user with access to search the directory can crash slapd by issuing a search including the Paged Results control with a page size of 0.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - openldap: incorrect multi-keyword mode cipherstring parsing (CVE-2015-3276)

  - /usr/libexec/openldap/generate-server-cert.sh in openldap-servers sets weak permissions for the TLS     certificate, which allows local users to obtain the TLS certificate by leveraging a race condition between     the creation of the certificate, and the chmod to protect it. (CVE-2016-4984)

  - servers/slapd/back-mdb/search.c in OpenLDAP through 2.4.44 is prone to a double free vulnerability. A user     with access to search the directory can crash slapd by issuing a search including the Paged Results     control with a page size of 0. (CVE-2017-9287)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This update for openldap2 fixes the following issues :

Security issues fixed :

CVE-2017-9287: A double free vulnerability in the mdb backend during search with page size 0 was fixed (bsc#1041764).

CVE-2017-17740: Fixed a denial of service (slapd crash) via a member MODDN operation that could have been triggered when both the nops module and the memberof overlay are enabled (bsc#1073313).

Non-security issues fixed: Fix a regression in handling of non-blocking connections (bsc#1031702)

Fix an uninitialised variable that causes startup failure (bsc#1037396)

Fix libldap leaks socket descriptors issue (bsc#1065083)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the openldap package has been released.

According to the version of the openldap packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A double-free flaw was found in the way OpenLDAP's     slapd server using the MDB backend handled LDAP     searches. A remote attacker with access to search the     directory could potentially use this flaw to crash     slapd by issuing a specially crafted LDAP search query.
    (CVE-2017-9287)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for openldap is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

OpenLDAP is an open source suite of Lightweight Directory Access Protocol (LDAP) applications and development tools. LDAP is a set of protocols used to access and maintain distributed directory information services over an IP network. The openldap packages contain configuration files, libraries, and documentation for OpenLDAP.

The following packages have been upgraded to a later upstream version:
openldap (2.4.44). (BZ#1386365)

Security Fix(es) :

* A double-free flaw was found in the way OpenLDAP's slapd server using the MDB backend handled LDAP searches. A remote attacker with access to search the directory could potentially use this flaw to crash slapd by issuing a specially crafted LDAP search query.
(CVE-2017-9287)

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.4 Release Notes linked from the References section.

The following packages have been upgraded to a later upstream version:
openldap (2.4.44).

Security Fix(es) :

  - A double-free flaw was found in the way OpenLDAP's slapd     server using the MDB backend handled LDAP searches. A     remote attacker with access to search the directory     could potentially use this flaw to crash slapd by     issuing a specially crafted LDAP search query.
    (CVE-2017-9287)

This update for openldap2 fixes the following issues :

  - Let OpenLDAP read system wide certificate directory by     default and avoid hiding the error if user specified CA     location cannot be read (boo#1009470).

  - Fix CVE-2017-9287: openldap2: Double free vulnerability     with patch (boo#1041764)

  - Fix an uninitialized variable that causes startup     failure (boo#1037396)

  - Fix a regression in handling of non-blocking connection     with (boo#1031702)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-1852 advisory.

    - fix CVE-2017-9287 openldap: Double free vulnerability in servers/slapd/back-mdb/search.c (#1458210)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security fix for CVE-2017-9287

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for openldap2 fixes the following issues: Security issues fixed :

  - CVE-2017-9287: A double free vulnerability in the mdb     backend during search with page size 0 was fixed     (bsc#1041764) Non security bugs fixed :

  - Let OpenLDAP read system-wide certificates by default     and don't hide the error if the user-specified CA     location cannot be read. (bsc#1009470)

  - Fix an uninitialised variable that causes startup     failure (bsc#1037396)

  - Fix an issue with transaction management that can cause     server crash (bsc#972331)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3307-1 advisory.

    Karsten Heymann discovered that OpenLDAP incorrectly handled certain search requests. A remote attacker     could use this issue to cause slapd to crash, resulting in a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It was discovered that there was a double-free vulnerability in the 'openldap' LDAP server.

A user with access to search the directory could crash slapd by issuing a search requesting a 'Paged Results' value set to zero.

For Debian 7 'Wheezy', this issue has been fixed in openldap version 2.4.31-2+deb7u3.

We recommend that you upgrade your openldap packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Karsten Heymann discovered that the OpenLDAP directory server can be crashed by performing a paged search with a page size of 0, resulting in denial of service. This vulnerability is limited to the MDB storage backend.

ID	Name	Product	Family	Severity
198770	RHEL 6 : openldap (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
124018	SUSE SLES12 Security Update : openldap2 (SUSE-SU-2019:0931-1)	Nessus	SuSE Local Security Checks	high
121713	Photon OS 1.0: Openldap PHSA-2017-0024	Nessus	PhotonOS Local Security Checks	medium
103060	EulerOS 2.0 SP2 : openldap (EulerOS-SA-2017-1202)	Nessus	Huawei Local Security Checks	medium
103059	EulerOS 2.0 SP1 : openldap (EulerOS-SA-2017-1201)	Nessus	Huawei Local Security Checks	medium
102735	CentOS 7 : openldap (CESA-2017:1852)	Nessus	CentOS Local Security Checks	medium
102649	Scientific Linux Security Update : openldap on SL7.x x86_64 (20170801)	Nessus	Scientific Linux Local Security Checks	medium
102555	openSUSE Security Update : openldap2 (openSUSE-2017-936)	Nessus	SuSE Local Security Checks	medium
102282	Oracle Linux 7 : openldap (ELSA-2017-1852)	Nessus	Oracle Linux Local Security Checks	medium
102144	RHEL 7 : openldap (RHSA-2017:1852)	Nessus	Red Hat Local Security Checks	medium
101795	Fedora 25 : openldap (2017-1ca18683e4)	Nessus	Fedora Local Security Checks	medium
100803	SUSE SLED12 / SLES12 Security Update : openldap2 (SUSE-SU-2017:1567-1)	Nessus	SuSE Local Security Checks	medium
100591	Ubuntu 14.04 LTS / 16.04 LTS : OpenLDAP vulnerability (USN-3307-1)	Nessus	Ubuntu Local Security Checks	medium
100576	Debian DLA-972-1 : openldap security update	Nessus	Debian Local Security Checks	medium
100522	Debian DSA-3868-1 : openldap - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2017-9287

medium

Tenable Plugins

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium