LDAP: OpenLDAP Ldapsearch Pagesize Double Free Denial Of Service
This signature detects attempts to exploit a known vulnerability in the ldapsearch function of OpenLDAP. Successful exploitation could lead to the OpenLDAP server process terminating abnormally.
Extended Description
servers/slapd/back-mdb/search.c in OpenLDAP through 2.4.44 is prone to a double free vulnerability. A user with access to search the directory can crash slapd by issuing a search including the Paged Results control with a page size of 0.
Affected Products
Redhat enterprise_linux_workstation
References
CVE: CVE-2017-9287
Short Name
LDAP:OPENLDAP-PAGESIZE-DOS
Severity
Major
Recommended
True
Recommended Action
Drop
Category
LDAP
Keywords
CVE-2017-9287 Denial Double Free Ldapsearch Of OpenLDAP Pagesize Service
Release Date
06/06/2017
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3590
False Positive
Unknown
Vendors
Oracle
Mcafee
Openldap
Debian
Redhat
CVSS Score
4.0