Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Sat, 28 Jun 2014 09:40:49 -0400 (EDT)
From: cve-assign@...re.org
To: mattd@...fuzz.com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE request / advisory: Cherokee

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

For reference, here is the URL mentioned on this list during the last
discussion of a CVE assignment related to LDAP and an empty string:

  http://securitysynapse.blogspot.ca/2013/09/dangers-of-ldap-null-base-and-bind.html

The Cherokee vulnerability here is essentially a misinterpretation of
an LDAP server response. Cherokee should be expecting the semantics:

  - If I send a username and a non-empty password, a successful bind means
    that that's the correct password for the user

  - If I send a username and an empty password, a successful bind means
    that (A) that's not the correct password for the user and (B)
    the LDAP server probably happens to allow unauthenticated information
    retrieval that might or might not be intentional

Instead, Cherokee incorrectly assumes that the semantics are:

  - If I send a username and any password (empty or non-empty), a
    successful bind means that that's the correct password for the user

Use CVE-2014-4668.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)

iQEcBAEBAgAGBQJTrsWJAAoJEKllVAevmvms4xsH/2Mp62a/D0Sfnbj2xFBCkt6I
fz/F0zC9Vue06vegJ/liSMJvpcJOxdO60lm1pEYAEXMdwM4OcewZ8+kRYhzCvOlf
ibEZlIi6YSh9AceI34NxGTzqhh2yVFApdm7uEdItr+ZT9g4uNejtjUdU+wQN5Ozx
8I4RJ5eYZPYNfrvru0RqvYW7iUOW2FG9nibhfZRSQ2NvsoJKXgMlz4GvknjqEijt
Mv0cyZ1PSNopcGcfdjyz568fEBy+0HWaEkx9EnQq1ni757B5D2iycSjleWsBRrgi
vQMOtmOEvVIC1RCVZuy8ZuTUIY8Lnfxxwmr7W+KjmiXtr2lUUhUZWHnM4s9d9bY=
=ukMd
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ