LDAP NULL BASE Search Access

This script is Copyright (C) 2011-2014 Tenable Network Security, Inc.


Synopsis :

The remote LDAP server may disclose sensitive information.

Description :

The remote LDAP server supports search requests with a NULL, or empty,
base object. This allows information to be retrieved without any prior
knowledge of the directory structure. Coupled with a NULL BIND, an
anonymous user may be able to query your LDAP server using a tool such
as 'LdapMiner'.

Note that there are valid reasons to allow queries with a NULL base.
For example, it is required in version 3 of the LDAP protocol to
provide access to the root DSA-Specific Entry (DSE), with information
about the supported naming context, authentication types, and the
like. It also means that legitimate users can find information in the
directory without any prior knowledge of its structure. As such, this
finding may be a false-positive.

See also :

http://support.microsoft.com/kb/837964

Solution :

If the remote LDAP server supports a version of the LDAP protocol
before v3, consider whether to disable NULL BASE queries on your LDAP
server.

Risk factor :

Medium / CVSS Base Score : 5.0
(CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N)

Family: Misc.

Nessus Plugin ID: 10722 (ldap_null_base.nasl)

Bugtraq ID:

CVE ID: