[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 17 Sep 2009 11:28:13 +0200
From: yersinia <yersinia.spiros@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: watch for LDAP anonymous binds and empty passwords
On Thu, Sep 17, 2009 at 12:54 AM, Steven M. Christey
<coley@...us.mitre.org>wrote:
>
> FYI, we've seen "LDAP anonymous binds and empty passwords" a couple times
> in CVE, the latest being PostgreSQL (IDs forthcoming). This smells like a
> general vuln class to me, so developers may want to re-examine their LDAP
> support. CVE-2009-1905 and CVE-2007-6714 are examples.
>
> I haven't investigated closely but the pattern may be that a blank
> password can return successful authentication when anonymous binds are
> allowed. There's a relatively rare history of LDAP-specific vulns, which
> suggests to me that not a lot of people have been looking for this.
>
> I yes, because i am a LDAP expert (or so) and have worked with 4 different
Directory Server.
Vulnerabilities as this, but only for some proprietary product, are leading
some security scanners like nessus, but not only, to signal vulnerability
for LDAP bind null, LDAP null base SEARCH and so. For this many LDAP
administrators are forced by their security deparment,who are ignorant of
these details but follow what they say the tools without understanding the
implications, to configure their LDAP server by disabling the anonymous bind
in general, also to the LDAP root DSE. But this is in direct violation of
RFC LDAP and subsequently causing a large quantity of issues with other
products that follow the RFC.
Free to ask if you want more details.
Best Regards
Elia
- Steve
>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
