AS/400 LDAP user accounts disclosure

From: Shalom Carmel (
Date: 03/26/05

  • Next message: "QuickTime malformed JPEG buffer overflow"
    To: "bugtraq" <>
    Date: Sat, 26 Mar 2005 18:54:03 +0200

    AS/400 LDAP user accounts disclosure

    By default, a new iSeries server comes with a pre-installed directory
    server,better known as an LDAP server.LDAP, or Lightweight
    Directory Access Protocol, is the industry standard for enterprise
    directory services, and forms the basis for many common directory
    applications such as Microsoft Active Directory,iPlanet directory,
    Oracle OID and others. On the AS400,this pre-installed service is
    turned on by default, although it is not necessary for the regular
    operations of the AS/400 server.
    The LDAP service can be used to enumerate the AS400 user profiles.

    The problem
    The AS400 system projected backend has the ability to map OS/400
    objects as entries within the LDAP-accessible directory tree.
    The projected objects are LDAP representations of OS/400 objects
    instead of actual entries stored in the LDAP server database.
    So far, OS/400 user profiles are the only objects
    being mapped or projected as entries within the directory tree.
    It is sufficient to retrieve the list of users with an LDAP search.
    To conduct such a search, you need any valid AS/400 account.
    The LDAP search ability is not dependant on any restrictions or
    special permissions the user may have.
    The search returns information about user profiles that are in the
    same group like the account we use for the exploit, and this situation
    is common enough in the legacy applications world.

    Vulnerable versions:
    OS400 version 5.2 and up.

    Turn LDAP off. You probably do not need it.


    For full details and sample code please read the PDF file found at

    Shalom Carmel

  • Next message: "QuickTime malformed JPEG buffer overflow"