oss-security - watch for LDAP anonymous binds and empty passwords

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / NEWS community lists Wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [thread-next>] [month] [year] [list]

Date: Wed, 16 Sep 2009 18:54:51 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
Subject: watch for LDAP anonymous binds and empty passwords

FYI, we've seen "LDAP anonymous binds and empty passwords" a couple times
in CVE, the latest being PostgreSQL (IDs forthcoming).  This smells like a
general vuln class to me, so developers may want to re-examine their LDAP
support.  CVE-2009-1905 and CVE-2007-6714 are examples.

I haven't investigated closely but the pattern may be that a blank
password can return successful authentication when anonymous binds are
allowed.  There's a relatively rare history of LDAP-specific vulns, which
suggests to me that not a lot of people have been looking for this.

- Steve

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.