Stack-based buffer overflow in Red Hat Enterprise Linux for x86_64 - CVE-2017-15134

Vulnerability identifier: #VU10254

CSH Severity: Low

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-15134

CWE-ID: CWE-121

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to improper handling of Lightweight Directory Access Protocol (LDAP) search filters by the 389-ds-base package. A remote attacker can send a specially crafted LDAP request, trigger a stack-based buffer overflow condition and cause the ns-slapd process to crash.

Successful exploitation of the vulnerability results in denial of service.

Red Hat Enterprise Linux for x86_64
Amazon Linux AMI
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for Power
Opensuse

Install update from vendor's website.

• https://access.redhat.com/security/cve/CVE-2017-15134

• Denial of service in Red Hat Enterprise Linux
• Amazon Linux AMI update for 389-ds-base
• OpenSUSE Linux update for 389-ds
• Red Hat update for 389-ds-base