Sec Bug->Req #62363 [Opn]: Lack of warning about anon. bind

Edit report at https://bugs.php.net/bug.php?id=62363&edit=1 ID: 62363 Updated by: stas@php.net Reported by: gewalopdrbat at gmail dot com Summary: Lack of warning about anon. bind Status: Open -Type: Security +Type: Feature/Change Request Package: LDAP related Operating System: Windows 7, Ubuntu 12.04 PHP Version: 5.4.4 Block user comment: N Private report: Y Previous Comments: ------------------------------------------------------------------------ [2012-06-19 07:11:44] gewalopdrbat at gmail dot com Description: ------------ Most of the cases where a security concern or a possibility unexpected behavior are happily mentioned in the PHP documentation as WARNINGS or NOTES. This case is very critical because many times the ldap_bind() function is used as in the Case 1 (see test script). According the https://tools.ietf.org/html/rfc4513#section-5.1.2 , Clients MUST check for empty passwords to avoid successful bind when the username is valid (I've also tested the username '*', and it produced a successful bind). It would be very nice to change the behavior of ldap_bind() and add a parameter to explicitly allow anonymous binding or at least mention the Case 2 in the examples (see test script). Test script: --------------- #Case 1 Code if (ldap_bind($ds, $rdn, $password)){ //reveal secret stuff } #Case 2 Code if (!empty($password) || $password != null) { if (ldap_bind($ds, escapeLDAP($rdn, 'dn'), $password)) { //reveal secret stuff } ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=62363&edit=1