Joe
Tue Jun 17 07:48:14 PDT 2008
I thought the LDAP spec said that RootDSE should be able to be queried
anonymously? I agree that calling this a vulnerability is probably unfair.
MS doesn't allow you to change this behavior in AD. It would also likely
break many programs if you could do this.
Joe K.
--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"
http://www.directoryprogramming.net
--
"Michael Ströder" <michael@stroeder.com> wrote in message
news:v36ki5-2cu.ln1@nb2.stroeder.com...
> stadala wrote:
>> Can you please suggest me how to resolve LDAP null base security
>> vulnarability reported by port scan?
>>
>>
http://xforce.iss.net/xforce/xfdb/1425
>
> They are talking about reading the root DSE as anonymous. IMHO that's a
> bit overstated since if you already know the AD domain's DNS name you also
> know the LDAP search base since it's simply the same name mapped 1:1 to
> dc-style distinguished name.
>
> With other LDAP servers you can simply set ACLs to prevent this from
> happen. But that's local security configuration. Don't know how to do this
> with AD though.
>
> Ciao, Michael.