LDAP allows null bases
Marcin Jakubiec <[email protected]> Tue, 16 Dec 2008 05:53:15 -0800 (PST)
| Newsgroups | gmane.comp.security.nessus.general |
|---|---|
| Message-ID | <[email protected]> |
Hi, Nessus found on my system that I have "Improperly configured LDAP servers will allow the directory BASE to be set to NULL. This allows information to be culled without any prior knowledge of the directory structure. Coupled with a NULL BIND an anonymous user can query your LDAP server using a tool such as 'LdapMiner'. Disable NULL BASE queries on your LDAP server". What does it mean and how to disable it? I use Sun Java System Directory Server 6.3. Thanks, Marcin _______________________________________________ Nessus mailing list [email protected] http://mail.nessus.org/mailman/listinfo/nessus