oss-security - watch for LDAP anonymous binds and empty passwords

Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Wed, 16 Sep 2009 18:54:51 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
Subject: watch for LDAP anonymous binds and empty passwords

FYI, we've seen "LDAP anonymous binds and empty passwords" a couple times
in CVE, the latest being PostgreSQL (IDs forthcoming).  This smells like a
general vuln class to me, so developers may want to re-examine their LDAP
support.  CVE-2009-1905 and CVE-2007-6714 are examples.

I haven't investigated closely but the pattern may be that a blank
password can return successful authentication when anonymous binds are
allowed.  There's a relatively rare history of LDAP-specific vulns, which
suggests to me that not a lot of people have been looking for this.

- Steve

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.