CVE-2017-14159: Medium severity red hat openldap servers vulnerability
Published Sep 5, 2017
·Updated
slapd in OpenLDAP 2.4.45 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a "kill cat /pathname" command, as demonstrated by openldap-initscript.
Affected Software
2 affected components
openldap OpenLDAP<=2.4.45
Oracle Blockchain Platform<21.1.2
Remediation
Patch Available
Event History
Sep 5, 2017
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2017-14159?
CVE-2017-14159 has been classified as a medium severity vulnerability.
2
How do I fix CVE-2017-14159?
To fix CVE-2017-14159, update OpenLDAP to version 2.4.46 or later.
3
What systems are affected by CVE-2017-14159?
CVE-2017-14159 affects OpenLDAP versions up to 2.4.45 and Oracle Blockchain Platform versions prior to 21.1.2.
4
Can local users exploit CVE-2017-14159?
Yes, local users can exploit CVE-2017-14159 to kill arbitrary processes using a non-root account.
5
What type of vulnerability is CVE-2017-14159?
CVE-2017-14159 is a local privilege escalation vulnerability.