RE: LDAP directory

From: BUGTRAQ (ivan.buetler@csnc.ch)
Date: 08/02/01 

From: "BUGTRAQ" <ivan.buetler@csnc.ch>
To: <peterraven@lycos.com>, <pen-test@securityfocus.com>
Subject: RE: LDAP directory
Date: Thu, 2 Aug 2001 07:56:29 +0200
Message-ID: <NEBBIBNPKKEKFKFAOGHFCEJJCOAA.ivan.buetler@csnc.ch>

Hi,

I my own opinion, pen-testing an ldap directory is mostly similar to audit a
file-system. You have objects (classes) containing attributes and you have
some objects you want to protect and others you will allow everyone to
access. ldap security will be secure, if you set proper access permissions.
If you just install ldap in it's default configuration, you might have some
troubles.

A major difference between the file-system issue and ldap is the distributed
topic. You have replications and distributed responsibilities. But at the
end, you need to do an administrative "BIND" by "cn=Manager" in order to
change the ldap behaviour as you would need "Domain Admin Rights" to change
the Windows file permissions.

Potential threats are:

- LDAP without SSL (for administration)
- Anonymous BIND contains write permissions
- Hacker tries to replicate by setting up his own LDAP server which he
controls
- Access to confidential data by an anonymous bind
- Access to confidential data by an authenticated bind but bad file
permissions
- Access to the "MANAGER" locally (without LDAP) by console application

I played around with "LDAPMiner", which does some basic LDAP tests for you.
But at the end, I am using simple tools like "GQ" or openldap utilities
"ldapsearch, ldapadd, etc" to do this tests.

Regards

Ivan

-----Original Message-----
From: Peter Raven [mailto:peterraven@lycos.com]
Sent: Wednesday, August 01, 2001 3:02 PM
To: pen-test@securityfocus.com
Subject: LDAP directory

Hi there,

does anyone have good starting points for pen-testing an LDAP directory
server? I'm looking for a threat analyses, security checklists, tools and
personal experiences especially on the LDAP service; not on the operating
system.

Thanks and greetings
Peter

Get 250 color business cards for FREE!
http://businesscards.lycos.com/vp/fastpath/

----------------------------------------------------------------------------
This list is provided by the SecurityFocus Security Intelligence Alert (SIA)
Service. For more information on SecurityFocus' SIA service which
automatically alerts you to the latest security vulnerabilities please see:
https://alerts.securityfocus.com/

----------------------------------------------------------------------------
This list is provided by the SecurityFocus Security Intelligence Alert (SIA)
Service. For more information on SecurityFocus' SIA service which
automatically alerts you to the latest security vulnerabilities please see:
https://alerts.securityfocus.com/

Relevant Pages

  • [NT] Vulnerability in Active Directory Allows Code Execution (MS08-060)
    ... Get your security news from a reliable source. ... Vulnerability in Active Directory Allows Code Execution ... implementations of Active Directory on Microsoft Windows 2000 Server. ... not be listening to Lightweight Directory Access Protocol (LDAP) or LDAP ...
    (Securiteam)
  • RE: LDAP + Active Directory
    ... Subject: LDAP + Active Directory ... current article series on Sfocus (An Audit of Active Directory Security)... ... that security in AD can get ... For more information on SecurityFocus' SIA service which ...
    (Pen-Test)
  • RE: LDAP + Active Directory
    ... Subject: LDAP + Active Directory ... LDAP uses an anonymous access for reading the tree, ... This list is provided by the SecurityFocus Security Intelligence Alert ... For more information on SecurityFocus' SIA service which ...
    (Pen-Test)
  • Re: LDAP + Active Directory
    ... Subject: LDAP + Active Directory ... This list is provided by the SecurityFocus Security Intelligence Alert ... For more information on SecurityFocus' SIA service which ...
    (Pen-Test)
  • [NEWS] Security Issue with GroupWise and LDAP Authentication in PostOffice (Anonymous bind)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... checks to what type of LDAP binding has occurred (Anonymous, ... GroupWise 6 Post Office using LDAP authentication AND security ... with the LDAP v3 RFC 2251, an LDAP bind in which a username is provided ...
    (Securiteam)