Microsoft Metadirectory Services Remote LDAP Client Administration Vulnerability

Bugtraq ID:	5308
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 25 2002 12:00AM
Updated:	Jul 25 2002 12:00AM
Credit:	Vulnerability discovery credited to Pascal Huijbers and Thomas de Klerk.
Vulnerable:	Microsoft Metadirectory Services 2.2
Not Vulnerable:	Microsoft Metadirectory Services 2.2 SP1

Microsoft Metadirectory Services Remote LDAP Client Administration Vulnerability

A problem has been discovered in Microsoft Metadirectory Services (MMS) that could allow a user of an LDAP client to gain administrative access.

MMS allows a remote user with an LDAP client to change data on a vulnerable server. A flaw in authentication design allows the user of the LDAP client to connect to the MMS repository, modify data, change the MMS configuration, and/or replicate the bogus data in other repositories.

Microsoft Metadirectory Services Remote LDAP Client Administration Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Microsoft Metadirectory Services Remote LDAP Client Administration Vulnerability

Solution:
Fix available:


Microsoft Metadirectory Services 2.2

• Microsoft Q317138
  http://download.microsoft.com/download/mms22/Patch/Q317138/NT5/EN-US/Q 317138.EXE

Microsoft Metadirectory Services Remote LDAP Client Administration Vulnerability

References:

• Microsoft Security Bulletin MS02-036 (Microsoft)
  
• Technet Security (Microsoft)