SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Security)  >   login_ldap Vendors:   Institute for Open Systems Technology Australia
login_ldap May Grant Access to Remote Users When No Password Is Supplied
SecurityTracker Alert ID:  1006138
SecurityTracker URL:  http://securitytracker.com/id/1006138
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Feb 21 2003
Impact:   Host/resource access via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 3.2 and prior versions (prior to login_ldap.c, v 1.16)
Description:   A vulnerability was reported in the 'login_ldap' authentication module for BSD (third party software for BSD). A remote user may be able to gain access to the system.

It is reported that login_ldap may grant access to remote users on systems that have enabled unauthenticated bind (via the 'allow bind_anon_cred' statement in the 'slapd.conf' file). According to the report, there are some LDAP applications that will generate an unauthenticated bind request when an authenticated access request was intended. If a remote user invokes one of these affected applications, login_ldap may grant the user access if no password is supplied. The specific impact depends on the affected application.

In OpenLDAP 2.0.x, the following operations lead to an anonymous bind by default:

It is reported that several LDAP operations in OpenLDAP 2.0.x may result in an anonymous bind, including the following:

- BIND with DN set but no password provided (bind_anon_dn)
- BIND with no DN but a password was provided (bind_anon_cred)
- BIND with no DN and no password (bind_anon)

In OpenLDAP 2.1.x, only the bind_anon is not disabled by default.

Sebastian Stark is credited with reporting this flaw.

Impact:   A remote user may be granted access when no password is supplied. The specific impact depends on the LDAP application that uses login_ldap.
Solution:   The vendor has released a fixed version (3.3), available at:

It is available here: http://www.ifost.org.au/~peterw/login_ldap-3.3.tar.gz

MD5 (login_ldap-3.3.tar.gz) = 52e905d54a136c3d850158f4f7548a3f

Also, any specific BIND method ('<feature>') can be disabled by using the following line in the slapd.conf file:

disallow <feature>

Vendor URL:  www.ifost.org.au/~peterw/advisory.txt (Links to External Site)
Cause:   Configuration error, State error
Underlying OS:  UNIX (BSD/OS), UNIX (OpenBSD)

Message History:   None.


 Source Message Contents

Subject:  login_ldap security announcement


Sebastian Stark from Directory Applications for Advanced Security and 
Information Management (http://www.daasi.de) has found a serious issue 
with login_ldap, affecting all versions. login_ldap is a BSD 
Authentication module for authenticating users off an LDAP server, and 
runs on OpenBSD and BSD/OS. It is third party software, and is not 
part of OpenBSD or BSD/OS.

>From http://www.openldap.org/doc/admin/security.html

"An unauthenticated bind results in an anonymous authorization. 
Unauthenticated bind mechanism is disabled by default, but can 
be enabled by specifying "allow bind_anon_cred" in slapd.conf(5). 
As a number of LDAP applications mistakenly generate 
unauthenticated bind request when authenticated access was 
intended (that is, they do not ensure a password was provided), 
this mechanism should generally not be enabled."

In OpenLDAP 2.0.x, the following operations lead to an anonymous bind
by default:

 - BIND with DN set but no password provided (bind_anon_dn)
 - BIND with no DN but a password was provided (bind_anon_cred)
 - BIND with no DN and no password (bind_anon)

You can disable any of those BIND methods by putting 'disallow
<feature>' into your slapd.conf where <feature> stands for the
corresponding keyword given in parentheses above.

In OpenLDAP 2.1.x all but bind_anon are disabled by default. For an
authentication service this is probably what most people want.

login_ldap has been updated to check that a password has been provided.

It is available here: http://www.ifost.org.au/~peterw/login_ldap-3.3.tar.gz
MD5 (login_ldap-3.3.tar.gz) = 52e905d54a136c3d850158f4f7548a3f

The other main change is it no longer installed setuid root, please see the
README included for more information.

I would encourage other people writing LDAP applications to check their 
software for this issue. Many thanks to Sebastian for his help with this
issue, work on a suitable fix and this advisory.

Peter Werner
Feb 21, 2003
--
IFOST: http://www.ifost.org.au

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC