Apache Shiro 1.2.2 LDAP Authentication Bypass

2014.03.05

Credit: The Apache Shiro Team

Risk: High

Local: No

Remote: Yes

CVE: CVE-2014-0074

CWE: CWE-287

Ogólna skala CVSS: 7.5/10

Znaczenie: 6.4/10

Łatwość wykorzystania: 10/10

Wymagany dostęp: Zdalny

Złożoność ataku: Niska

Autoryzacja: Nie wymagana

Wpływ na poufność: Częściowy

Wpływ na integralność: Częściowy

Wpływ na dostępność: Częściowy

Dear Apache Shiro Community,

The Apache Shiro team has released Apache Shiro version 1.2.3. This is the
third bug fix point release after 1.2.0.

All binaries (.jars) are available in Maven Central already.


This release includes 1 critical vulnerability and is available for
Download [1] now.
 SHIRO-460 - LDAP authentication succeeds even if the user name and
password is not passed. [2] [CVE-2014-0074]

Versions Affected:
1.0.0-incubating - 1.2.2

Details:
When using an LDAP server that allows unauthenticated bind, Shiro will
authenticate users with an empty password.
NOTE: this is NOT the default for OpenLDAP

Mitigation:
Users should upgrade to 1.2.3

Workaround:
Disable unauthenticated binds on your LDAP server (best practice).


Cheers,

The Apache Shiro Team

[1] http://shiro.apache.org/download.html
[2] https://issues.apache.org/jira/browse/SHIRO-460

Referencje:

http://shiro.apache.org/download.html

https://issues.apache.org/jira/browse/SHIRO-460

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Apache Shiro 1.2.2 LDAP Authentication Bypass

Referencje:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.