AS/400 LDAP user accounts disclosure

From: Shalom Carmel (shalom_at_venera.com)
Date: 03/26/05

  • Next message: liquid_at_cyberspace.org: "QuickTime malformed JPEG buffer overflow"
    To: "bugtraq" <bugtraq@securityfocus.com>
    Date: Sat, 26 Mar 2005 18:54:03 +0200
    
    

    AS/400 LDAP user accounts disclosure

    Overview
    -------------
    By default, a new iSeries server comes with a pre-installed directory
    server,better known as an LDAP server.LDAP, or Lightweight
    Directory Access Protocol, is the industry standard for enterprise
    directory services, and forms the basis for many common directory
    applications such as Microsoft Active Directory,iPlanet directory,
    Oracle OID and others. On the AS400,this pre-installed service is
    turned on by default, although it is not necessary for the regular
    operations of the AS/400 server.
    The LDAP service can be used to enumerate the AS400 user profiles.

    The problem
    ----------------
    The AS400 system projected backend has the ability to map OS/400
    objects as entries within the LDAP-accessible directory tree.
    The projected objects are LDAP representations of OS/400 objects
    instead of actual entries stored in the LDAP server database.
    So far, OS/400 user profiles are the only objects
    being mapped or projected as entries within the directory tree.
    It is sufficient to retrieve the list of users with an LDAP search.
    To conduct such a search, you need any valid AS/400 account.
    The LDAP search ability is not dependant on any restrictions or
    special permissions the user may have.
    The search returns information about user profiles that are in the
    same group like the account we use for the exploit, and this situation
    is common enough in the legacy applications world.

    Vulnerable versions:
    ------------------------
    OS400 version 5.2 and up.

    Workaround
    ----------------
    Turn LDAP off. You probably do not need it.

    References
    http://publib.boulder.ibm.com/iseries/v5r2/ic2924/info/rzahy/rzahyldapops.htm

    For full details and sample code please read the PDF file found at
    http://www.venera.com/downloads

    Shalom Carmel


  • Next message: liquid_at_cyberspace.org: "QuickTime malformed JPEG buffer overflow"

    Relevant Pages

    • LDAP Weirdness (Solaris 9)
      ... I'm having a very odd problem with LDAP authentication on a Solaris 9 ... The LDAP server is running OpenLDAP with a self-signed ... that you would expect for an account that doesn't exist. ...
      (comp.unix.solaris)
    • RE: LDAP Test error unable to authenticate user
      ... 825763 How to configure Internet access in Windows Small Business Server ... Since the issue happen only on one client computer, ... Delete the computer account from SBS domain: ... LDAP Test error unable to authenticate user ...
      (microsoft.public.windows.server.sbs)
    • Re: Does samba 3.0.14Aa on OS 5.0.6 work with ldapsam backend on another LDAP server?
      ... used 3.0.9 on SCO 5.0.6 for quite some time after suffering problems I ... a RedHat4 box running samba 3.0.10 and OpenLDAP 2.2.13. ... and no LDAP server (although there were the ... share on the SCO server without any smbpasswd on that server! ...
      (comp.unix.sco.misc)
    • Re: Creating SID Manaully
      ... server that are specific to that class. ... though LDAP). ... account to ACL local resources like files or folders? ... current account request system works on the honor system. ...
      (microsoft.public.windows.server.active_directory)
    • RE: LDAP & Find People not working
      ... need to refer to the KB article below to know how to use LDAP: ... | Yes, the scanner is on the local area network, so as you indicated below, ... | So I wonder why the scanner does not see the LDAP server. ...
      (microsoft.public.windows.server.sbs)