login_ldap security announcement

From: Peter Werner (peterw@ifost.org.au)
Date: 02/20/03

  • Next message: Lucas Armstrong: "PHPNuke SQL Injection" 
    Date: Fri, 21 Feb 2003 09:09:36 +1100
From: Peter Werner <peterw@ifost.org.au>
To: bugtraq@securityfocus.com

    Sebastian Stark from Directory Applications for Advanced Security and
    Information Management (http://www.daasi.de) has found a serious issue
    with login_ldap, affecting all versions. login_ldap is a BSD
    Authentication module for authenticating users off an LDAP server, and
    runs on OpenBSD and BSD/OS. It is third party software, and is not
    part of OpenBSD or BSD/OS.

    From http://www.openldap.org/doc/admin/security.html

    "An unauthenticated bind results in an anonymous authorization.
    Unauthenticated bind mechanism is disabled by default, but can
    be enabled by specifying "allow bind_anon_cred" in slapd.conf(5).
    As a number of LDAP applications mistakenly generate
    unauthenticated bind request when authenticated access was
    intended (that is, they do not ensure a password was provided),
    this mechanism should generally not be enabled."

    In OpenLDAP 2.0.x, the following operations lead to an anonymous bind
    by default:

     - BIND with DN set but no password provided (bind_anon_dn)
     - BIND with no DN but a password was provided (bind_anon_cred)
     - BIND with no DN and no password (bind_anon)

    You can disable any of those BIND methods by putting 'disallow
    <feature>' into your slapd.conf where <feature> stands for the
    corresponding keyword given in parentheses above.

    In OpenLDAP 2.1.x all but bind_anon are disabled by default. For an
    authentication service this is probably what most people want.

    login_ldap has been updated to check that a password has been provided.

    It is available here: http://www.ifost.org.au/~peterw/login_ldap-3.3.tar.gz
    MD5 (login_ldap-3.3.tar.gz) = 52e905d54a136c3d850158f4f7548a3f

    The other main change is it no longer installed setuid root, please see the
    README included for more information.

    I would encourage other people writing LDAP applications to check their
    software for this issue. Many thanks to Sebastian for his help with this
    issue, work on a suitable fix and this advisory.

    Peter Werner
    Feb 21, 2003 

    --
IFOST: http://www.ifost.org.au

    Relevant Pages

    • Re: LDAP Authentication for Single Sign On
      ... So no authentication is required when performing bind operations only ... If I do find that I have to create a service account can you steer me ... If the client doesn't support anything other than a simple ... That isn't really necessarily part of the authentication though. ...
      (microsoft.public.windows.server.active_directory)
    • Re: Query AD from DMZ via LDAP?
      ... You could use ADAM with passthrough authentication or bind proxy objects, ... Determining group memberships would be a bonus. ...
      (microsoft.public.windows.server.active_directory)
    • Re: adam bind-redirect
      ... a third party doing authentication) then the proxy-redirect isnt an option. ... could benefit from bind redirect/User Proxy Object ... >> Our Adam will have a user store where we put custom user attributes. ... > Integrated authentication gives you a Windows security context ...
      (microsoft.public.windows.server.active_directory)
    • Re: Random logon failure with ADAM Bind Proxy
      ... to the Readers role for an ADAM NC and it worked fine for binding ADAM ... In this thread the original poster is using bind proxies so it might be ... Readers role, he could add the Users role to the Readers role which would ... > Could he also just bind to RootDSE in order to force an authentication? ...
      (microsoft.public.windows.server.active_directory)
    • Re: adam bind-redirect
      ... You won't be able to do a proxy bind if you don't have the ... This will work only if ADAM ... >>> being authenticated (as in windows authentication or ... >> of the bind proxy object in the ADAM naming context and the Windows ...
      (microsoft.public.windows.server.active_directory)