PT-2014-6050 · Cherokee · Cherokee

Matthew Daley · Publicado 2014-07-02 · Atualizado 2017-01-03 · CVE-2014-4668

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cherokee versions 1.2.103 and earlier

Description The issue concerns the cherokee validator ldap check function in validator ldap.c. When LDAP is used, it does not properly consider unauthenticated-bind semantics. This allows remote attackers to bypass authentication by using an empty password.

Recommendations For Cherokee versions 1.2.103 and earlier, consider disabling the LDAP authentication mechanism until a patch is available. Restrict access to the cherokee validator ldap check function to minimize the risk of exploitation. Avoid using empty passwords in the affected LDAP configuration until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2014-4668

MGASA-2015-0181

Produtos afetados

Cherokee

Referências · 15

• https://github.com/cherokee/webserver/commit/fbda667221c51f0aa476a02366e0cf66cb012f88 · Nota
• http://mandriva.com/security/advisories?name=MDVSA-2015:225 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2014/06/28/7 · Nota
• http://openwall.com/lists/oss-security/2014/06/28/3 · Nota
• http://advisories.mageia.org/MGASA-2015-0181.html · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156190.html · Aviso do Fabricante
• http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156162.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-4668 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4668 · Nota
• https://osv.dev/vulnerability/MGASA-2015-0181 · Aviso do Fabricante
• https://lists.fedoraproject.org/pipermail/package-announce/2015-April/155776.html · Aviso do Fabricante
• http://securityfocus.com/bid/68249 · Nota
• https://advisories.mageia.org/MGASA-2015-0181.html · Nota de Segurança
• http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155776.html · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=15755 · Nota