Screencast: AM LDAP Bug

Serious security vulnerability using Sun Access Manager 7.1 update 1 authenticating against Sun Directory Server 5.2.

Originally mentioned in: http://forum.java.sun.com/thread.jspa?threadID=5275151

In relation to a known DS 5.2 issue: http://docs.sun.com/source/819-2405/index.html#wp49398

Which says:

Bind With Zero-Length Password Is Treated as an Anonymous Bind (4703503)
If you use a zero-length password to bind to a directory, your bind is an anonymous bind - it is not a simple bind. Third party applications that authenticate users by performing a test bind might exhibit a security hole if they are not aware of this behavior.

Category:

Howto & Style

Tags:

• sun
• accessmanager
• bug
• security
• authentication