| VID |
23016 |
| Severity |
30 |
| Port |
389 |
| Protocol |
TCP |
| Class |
LDAP |
| Detailed Description |
The LDAP server is improperly configured and allows anonymous bases (The directory BASE is set to NULL). If LDAP allows a NULL base in an LDAP search, a user can run a search that returns information on namingContexts and supported controls. An attacker could use this information for malicious activity such as accessing directory listings. Coupled with a NULL BIND, an anonymous user can query your LDAP server using a tool such as 'LdapMiner'.
* References:
http://www.iss.net/security_center/static/1425.php
ftp://ftp.isi.edu/in-notes/rfc2251.txt |
| Recommendation |
Disable NULL BASE queries on the LDAP server, and Use an access list control to prevent users from dumping the base of the tree or issuing a request without knowing the base object.
For Windows platforms:
If pre-Windows 2000 compatibility is not required, remove pre-Windows 2000 compatibility as follows :
1. Start cmd.exe (From the Windows system Start menu, select Run, type cmd.exe, and click OK.)
2. Type the following command and press Enter key:
net localgroup 'Pre-Windows 2000 Compatible Access' everyone /delete
3. Restart the host
For NetWare platforms:
Disable or restrict anonymous binds in LDAP if not required, as listed in http://support.novell.com/cgi-bin/search/searchtid.cgi?/10077872.htm
For other distributions:
Contact your vendor for this information |
| Related URL |
(CVE) |
| Related URL |
(SecurityFocus) |
| Related URL |
(ISS) |
|
