CVE-2017-9277: existing connection is being used even though eDirectory LDAP server is upgraded to EBA
Published Mar 2, 2018
·Updated
The LDAP backend in Novell eDirectory before 9.0 SP4 when switched to EBA (Enhanced Background Authentication) kept open connections without EBA.
Affected Software
4 affected components
Novell eDirectory<=9.0
Novell eDirectory=9.0-sp1
Novell eDirectory=9.0-sp2
Novell eDirectory=9.0-sp3
Event History
Mar 2, 2018
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is CVE-2017-9277?
CVE-2017-9277 is a vulnerability in Novell eDirectory before 9.0 SP4 that allows for open connections without Enhanced Background Authentication (EBA).
2
What is the severity of CVE-2017-9277?
The severity of CVE-2017-9277 is high with a CVSS score of 7.5.
3
How does CVE-2017-9277 affect Novell eDirectory?
CVE-2017-9277 affects Novell eDirectory versions before 9.0 SP4 when switched to EBA by keeping open connections without EBA.
4
Which versions of Novell eDirectory are affected by CVE-2017-9277?
Novell eDirectory versions 9.0, 9.0-sp1, 9.0-sp2, and 9.0-sp3 are affected by CVE-2017-9277.
5
How can I fix CVE-2017-9277?
To fix CVE-2017-9277, update Novell eDirectory to version 9.0 SP4 or later.