|
Posted by Joe Richards [MVP] on September 8, 2005, 5:09 pm
Please log in for more thread options
AD DCs must have anonymous bind capability to the RootDSE as it is an RFC item
for LDAPv3. Once you are bound anonymously, the level of info available isn't
generally that great unless someone has really opened up security.
--
Joe Richards Microsoft MVP Windows Server Directory Services
www.joeware.net
Neil wrote:
> This is vulnerability that I wanted to get rid of on couple of servers and I
> tried reading the article. It looks that it is more of an Exchange violation.
> But, we have 2 DNS servers and 2 DC's which have these violations. Kind of
> confused, what to do. Any ideas? I have more info below in regard to this
> violation.
>
>
> LDAP allows anonymous binds
> Check for LDAP null bind
>
> Improperly configured LDAP servers will allow any user to connect to the
> server and query for information.
>
> Solution: Disable NULL BIND on your LDAP server
>
> In addition, the LDAP bind function in Exchange 5.5 has a buffer overflow
> that allows a user to conduct a denial of service or execute commands in all
> versions prior to Exchange server SP2. Coupled with a NULL BIND, an
> anonymous user can mount a remote attack against your server.
>
> Note: no test was done to see what version of Exchange server is running,
> nor attempt to verify the service pack.
>
> Solution: see http://www.microsoft.com/technet/security/bulletin/ms99-009.mspx
> Risk factor: Medium
>
| 
XML Sitemap