PT-2003-2379 · Unknown · Login Ldap

Published 2003-12-31 · Updated 2017-07-29 · CVE-2003-1434

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions login ldap versions 3.1 through 3.2

Description The issue allows remote attackers to initiate unauthenticated bind requests under certain conditions. This can happen if bind anon dn is enabled, allowing a bind with no password provided, or if bind anon cred is enabled, allowing a bind with no DN. Additionally, if bind anon is enabled, it allows a bind with no DN or password.

Recommendations For versions 3.1 and 3.2, consider disabling the bind anon dn, bind anon cred, and bind anon features to prevent unauthenticated bind requests until a patch is available. Restrict access to the login functionality to minimize the risk of exploitation.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2003-1434

Affected Products

Login Ldap

References · 4

• http://securityfocus.com/bid/6903 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2003-1434 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/11374 · Note
• http://archives.neohapsis.com/archives/bugtraq/2003-02/0244.html · Note