thedark
Second Lieutenant
Joined: 30 Jul 2005
Posts: 1074
|
 Posted: Sat Jul 30, 2005 3:17 pm Post subject: Function Exposed via LDAP over SSL Could Enable Passwords to |
 |
|
This vulnerability involves an LDAP function that is only available if the LDAP server has been configured to support LDAP over SSL sessions, and whose purpose is to allow users to change the data attributes of directory principals. By design, the function should check the authorizations of the user before completing the request; however, it contains an error that manifests itself only when the directory principal is a domain user and the data attribute is the domain password -- when this is the case, the function fails to check the permissions of the requester, with the result that it could be possible for a user to change any other user’s domain login password.
Patch: http://www.microsoft.com/Downloads/Release.asp?ReleaseID=31065 |
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
