PT-2007-5545 · Openldap+2 · Ldap+2

Published 2007-08-15 · Updated 2017-07-29 · CVE-2007-4364

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Fedora Commons versions prior to 2.2.1

Description The issue is related to improper handling of certain authentication requests involving Java Naming and Directory Interface (JNDI). This can be exploited in two ways: (1) using a nonexistent account name in combination with an empty password, which can trigger an unexpected response from an LDAP server, and (2) a reauthentication attempt that throws an exception, allowing the use of a cached authentication decision. Authentication can be bypassed by using the first vector followed by the second, and possibly by using a single vector.

Recommendations For versions prior to 2.2.1, update to version 2.2.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the JNDI interface until a patch is applied. Avoid using empty passwords in authentication requests to minimize the risk of exploitation.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2007-4364

Affected Products

Fedora Commons

Java Naming/Directory Interface

Ldap

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2007-4364 · Security Note
• http://secunia.com/advisories/26445 · Vendor Advisory
• http://sourceforge.net/tracker/index.php?func=detail&aid=1731608&group_id=177054&atid=879703 · Note
• http://osvdb.org/39548 · Note
• http://securityfocus.com/bid/25317 · Note
• http://sourceforge.net/project/shownotes.php?release_id=531870 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36005 · Note