Critical Denial of Service Vulnerability in OpenLDAP - CVE-2017-17740
Summary
ALPINE-CVE-2017-17740: contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to ca... Affects openldap versions < 2.4.46-r0. Fixed in 2.4.46-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenLDAP is an open-source implementation of the Lightweight Directory Access Protocol (LDAP), which is used for directory services. It provides a robust platform for managing user information and authentication in various applications. The package is widely utilized in enterprise environments for its scalability and flexibility. However, it has been identified that certain configurations can lead to vulnerabilities, such as CVE-2017-17740, which can compromise the stability of the service.
Vulnerability Detail
The vulnerability, identified as CVE-2017-17740, exists in the contrib/slapd-modules/nops/nops.c file of OpenLDAP versions up to 2.4.45. When both the nops module and the memberof overlay are enabled, the software attempts to free a buffer that was allocated on the stack. This flaw allows remote attackers to exploit the system, leading to a denial of service (DoS) condition by causing the slapd process to crash. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
2.4.46-r0
This is the first release that contains the fix.
sudo apk add --upgrade openldapTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the nops module or the memberof overlay in your OpenLDAP configuration to mitigate the risk of exploitation until the package is updated. This can be done by commenting out the relevant lines in your slapd configuration file.
Conclusion
CVE-2017-17740 is a significant vulnerability in OpenLDAP that can lead to denial of service. It is crucial for users to update to the patched version to ensure the stability and security of their directory services. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for openldap →
FAQ
CVE-2017-17740 is a vulnerability in OpenLDAP that can lead to a denial of service due to improper handling of memory allocation.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can cause the OpenLDAP service to crash, leading to potential downtime and disruption of services relying on directory access.
Yes, a patch is available in version 2.4.46-r0 of OpenLDAP. It is recommended to update to this version or later.
If immediate updating is not possible, consider disabling the nops module or the memberof overlay as a temporary workaround to reduce risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for openldap.
