CVE-2017-9287

What it actually does

Double free in OpenLDAP slapd back-mdb search handling when a Paged Results control with page size 0 is processed, resulting in memory corruption that crashes the daemon and produces denial of service.

Why it matters to the business

Directory service outages interrupt authentication, authorization, and directory lookups for dependent applications, causing operational downtime; the vulnerability appears in widely used packaging such as WordPress and Helm deployments.

How an attack unfolds

An attacker with directory search privileges crafts a search request that includes the LDAP Paged Results control specifying a page size of zero. The request reaches the vulnerable back-mdb code path, triggering the double free and immediate slapd termination. Public exploit code has been available since disclosure.

How to fix it

Upgrade affected OpenLDAP deployments to the fixed revisions supplied by each product: wordpress/wordpress to commit ab5f082a5c8b958175e9860b4aff947a3b354f6c and helm (Bitnami) to version 3.6.1 or later. Where direct OpenLDAP upgrades are used, apply the corresponding upstream patch that eliminates the double-free path.

How to confirm the fix worked

Confirm the installed package or source revision matches a listed fixed version, then execute a directory search that includes the Paged Results control with page size zero against a non-production instance and verify the server remains stable.

Typical attack path

1. Obtain or compromise an account with LDAP search rights
2. Issue a search operation containing the Paged Results control set to page size zero
3. Trigger double-free condition in back-mdb/search.c
4. Observe slapd crash and loss of directory availability

How to detect it

Review slapd process and system logs for abrupt terminations coinciding with LDAP search operations; inspect core dumps or backtraces that reference back-mdb/search.c around the time of the crash.

What your security team should do

• Prioritize upgrade of all listed affected products within the next maintenance window
• Temporarily restrict LDAP search access to trusted principals until patches are applied
• Add monitoring for unexpected slapd process terminations and review crash logs