PT-2003-2379 · Unknown · Login Ldap

Publicado 2003-12-31 · Atualizado 2017-07-29 · CVE-2003-1434

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions login ldap versions 3.1 through 3.2

Description The issue allows remote attackers to initiate unauthenticated bind requests under certain conditions. This can happen if bind anon dn is enabled, allowing a bind with no password provided, or if bind anon cred is enabled, allowing a bind with no DN. Additionally, if bind anon is enabled, it allows a bind with no DN or password.

Recommendations For versions 3.1 and 3.2, consider disabling the bind anon dn, bind anon cred, and bind anon features to prevent unauthenticated bind requests until a patch is available. Restrict access to the login functionality to minimize the risk of exploitation.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2003-1434

Produtos afetados

Login Ldap

Referências · 4

• http://securityfocus.com/bid/6903 · Correção
• https://exchange.xforce.ibmcloud.com/vulnerabilities/11374 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2003-1434 · Nota de Segurança
• http://archives.neohapsis.com/archives/bugtraq/2003-02/0244.html · Nota