Date: Sat, 28 Jun 2014 09:40:49 -0400 (EDT) From: cve-assign@...re.org To: mattd@...fuzz.com Cc: cve-assign@...re.org, oss-security@...ts.openwall.com Subject: Re: CVE request / advisory: Cherokee -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 For reference, here is the URL mentioned on this list during the last discussion of a CVE assignment related to LDAP and an empty string: http://securitysynapse.blogspot.ca/2013/09/dangers-of-ldap-null-base-and-bind.html The Cherokee vulnerability here is essentially a misinterpretation of an LDAP server response. Cherokee should be expecting the semantics: - If I send a username and a non-empty password, a successful bind means that that's the correct password for the user - If I send a username and an empty password, a successful bind means that (A) that's not the correct password for the user and (B) the LDAP server probably happens to allow unauthenticated information retrieval that might or might not be intentional Instead, Cherokee incorrectly assumes that the semantics are: - If I send a username and any password (empty or non-empty), a successful bind means that that's the correct password for the user Use CVE-2014-4668. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJTrsWJAAoJEKllVAevmvms4xsH/2Mp62a/D0Sfnbj2xFBCkt6I fz/F0zC9Vue06vegJ/liSMJvpcJOxdO60lm1pEYAEXMdwM4OcewZ8+kRYhzCvOlf ibEZlIi6YSh9AceI34NxGTzqhh2yVFApdm7uEdItr+ZT9g4uNejtjUdU+wQN5Ozx 8I4RJ5eYZPYNfrvru0RqvYW7iUOW2FG9nibhfZRSQ2NvsoJKXgMlz4GvknjqEijt Mv0cyZ1PSNopcGcfdjyz568fEBy+0HWaEkx9EnQq1ni757B5D2iycSjleWsBRrgi vQMOtmOEvVIC1RCVZuy8ZuTUIY8Lnfxxwmr7W+KjmiXtr2lUUhUZWHnM4s9d9bY= =ukMd -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ