OpenLDAP 2.4.45 and Earlier PID File Modification Vulnerability (CVE-2017-14159)
Summary
CVE-2017-14159: slapd in OpenLDAP 2.4.45 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID fil... Affects openldap versions < 2.4.46-r0. Fixed in 2.4.46-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenLDAP is an open-source implementation of the Lightweight Directory Access Protocol (LDAP) used for managing and accessing directory information. It provides a centralized repository for storing and retrieving user and system data. OpenLDAP is widely used in various applications and systems for authentication and authorization purposes. However, versions 2.4.45 and earlier of OpenLDAP are vulnerable to a PID file modification issue.
Vulnerability Detail
The vulnerability (CVE-2017-14159) in OpenLDAP arises when the slapd process creates a PID file after dropping privileges to a non-root account. This allows local users with access to the non-root account to modify the PID file before a root script executes a 'kill cat /pathname' command. By leveraging this access, an attacker can kill arbitrary processes, potentially leading to denial of service or unauthorized termination of critical processes.
How To Fix
Minimum fixed version
2.4.46-r0
This is the first release that contains the fix.
sudo apk add --upgrade openldapTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can manually modify the permissions of the PID file to restrict access only to authorized users. By setting appropriate file permissions, the risk of unauthorized modification can be reduced. However, applying the official fix by updating OpenLDAP is the recommended solution.
Conclusion
The OpenLDAP 2.4.45 and earlier PID file modification vulnerability (CVE-2017-14159) poses a risk of unauthorized process termination. It is recommended to update OpenLDAP to version 2.4.46-r0 or later to fix this vulnerability. Applying proper file permissions to the PID file can serve as a temporary workaround. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for openldap →
FAQ
OpenLDAP is an open-source implementation of the LDAP protocol used for managing directory information.
The vulnerability allows local users to kill arbitrary processes, potentially leading to denial of service or unauthorized termination of critical processes.
To fix this vulnerability, update OpenLDAP to version 2.4.46-r0 or later.
Yes, you can manually modify the permissions of the PID file to restrict access only to authorized users.
Yes, regularly updating software is crucial to mitigate security risks and address vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for openldap.
