note 73718 added to function.ldap-bind

A number of examples and implementations of authentication schemes which use LDAP simple binds to authenticate users fail to properly sanitize user-submitted data. This can allow for an anonymous user to authenticate to a web-based application as an existing user. Provided below is a brief description and example of how this vulnerability can arise. For more detailed information please visit the links at the bottom of this posting. The bind operation of LDAP, as described in RFC 4513, provides a method which allows for authentication of users. For the Simple Authentication Method a user may use the anonymous authentication mechanism, the unauthenticated authentication mechanism, or the name/password authentication mechanism. The unauthenticated authentication mechanism is used when a client who desires to establish an anonymous authorization state passes a non-zero length distinguished name and a zero length password. Most LDAP servers either can be configured to allow this mechanism or allow it by default. Web-based applications which perform the simple bind operation with the client's credentials are at risk when an anonymous authorization state is established. This can occur when the web-based application passes a distinguished name and a zero length password to the LDAP server. This is commonly encountered when no password is provided from the client to the web-based application. This situation is described in some of the postings found below. For this situation, the recommendations found in other postings is sufficient to prevent authentication bypass. However, no prior postings at php.net describe a situation in which a client may pass a distinguished username and a password of non-zero length to the web-based application which results in an anonymous authorization state. Below is an example of this situation. $dn="testuser"; $pass="\x00\x41"; if (empty($dn) or empty($pass)) { exit(); } //check for empty strings //if (preg_match('/[^a-zA-Z]/',$dn) or preg_match('/[^a-zA-Z0-9\x20!@#$%^&*()]/',$pass)) { exit(); } //check for expected values (whitelisting) //if (preg_match('/\x00/',$dn) or preg_match('/\x00/',$pass)) { exit(); } //check for null byte (blacklisting) $ldapconn=ldap_connect("192.0.2.2") or die("Could not connect to LDAP server."); if ($ldapconn) { ldap_set_option($ldapconn, LDAP_OPT_PROTOCOL_VERSION, 3); $ldapbind=ldap_bind($ldapconn, $dn, $pass); if ($ldapbind) { echo("success"); } else { echo("fail"); } } References: http://security.okstate.edu ---- Server IP: 64.71.164.2 Probable Submitter: 139.78.128.113 ---- Manual Page -- http://www.php.net/manual/en/function.ldap-bind.php Edit -- https://master.php.net/note/edit/73718 Del: integrated -- https://master.php.net/note/delete/73718/integrated Del: useless -- https://master.php.net/note/delete/73718/useless Del: bad code -- https://master.php.net/note/delete/73718/bad+code Del: spam -- https://master.php.net/note/delete/73718/spam Del: non-english -- https://master.php.net/note/delete/73718/non-english Del: in docs -- https://master.php.net/note/delete/73718/in+docs Del: other reasons-- https://master.php.net/note/delete/73718 Reject -- https://master.php.net/note/reject/73718 Search -- https://master.php.net/manage/user-notes.php