login_ldap Module Unauthorized Access Vulnerability

Bugtraq ID:	6903
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Feb 21 2003 12:00AM
Updated:	Feb 21 2003 12:00AM
Credit:	Discovery of this vulnerability has been credited to Sebastian Stark.
Vulnerable:	Peter Werner login_ldap 3.2 Peter Werner login_ldap 3.1
Not Vulnerable:	Peter Werner login_ldap 3.3

login_ldap Module Unauthorized Access Vulnerability

A vulnerability has been discovered in the login_ldap module. The issue occurs when the module is used in conjunction with specific LDAP server configurations.
It may be possible for an attacker to gain anonymous authorization on affected systems running login_ldap. Multiple versions of at least one LDAP server, OpenLDAP, ships with a default configuration that allows exploitation of this vulnerability.

login_ldap Module Unauthorized Access Vulnerability

Solution:
The vendor has supplied the following update:


Peter Werner login_ldap 3.1

• Peter Werner login_ldap-3.3.tar.gz
  http://www.ifost.org.au/~peterw/login_ldap-3.3.tar.gz

Peter Werner login_ldap 3.2

• Peter Werner login_ldap-3.3.tar.gz
  http://www.ifost.org.au/~peterw/login_ldap-3.3.tar.gz

login_ldap Module Unauthorized Access Vulnerability

References:

• login_ldap Homepage (Peter Werner)
  
• OpenLDAP Homepage (OpenLDAP)
  
• login_ldap security announcement (Peter Werner )