PT-2017-14980 · Openldap+3 · Openldap+3

Published 2017-12-18 · Updated 2025-08-12 · CVE-2017-17740

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenLDAP versions through 2.4.45

Description The issue arises when both the nops module and the memberof overlay are enabled in OpenLDAP. It allows remote attackers to cause a denial of service, resulting in a slapd crash, via a member MODDN operation. This occurs because the software attempts to free a buffer that was allocated on the stack.

Recommendations For OpenLDAP versions through 2.4.45, consider disabling the nops module or the memberof overlay as a temporary workaround to prevent the denial of service. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2018-2248

CVE-2017-17740

ECHO-B461-3162-6FB3

MGASA-2020-0200

OPENSUSE-SU-2019:2157-1

OPENSUSE-SU-2019:2176-1

OPENSUSE-SU-2019_2157-1

OPENSUSE-SU-2019_2176-1

OPENSUSE-SU-2024:11121-1

SUSE-SU-2018:4150-1

SUSE-SU-2018_4150-1

SUSE-SU-2019:0931-1

SUSE-SU-2019:2395-1

SUSE-SU-2019_0931-1

SUSE-SU-2019_2395-1

Affected Products

Alt Linux

Debian

Openldap

Suse

References · 45

• https://oracle.com/security-alerts/cpuapr2022.html · Patch
• https://advisories.mageia.org/MGASA-2020-0200.html · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2019:0931-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:4150-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2017-17740 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00053.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:2157-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2020-0200 · Vendor Advisory
• http://openldap.org/its/index.cgi/Incoming?id=8759 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-17740 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2019:2176-1 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2017-17740 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00058.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:2395-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-17740 · Vendor Advisory