Debian update for libspring-ldap-java



Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2017-8028
CWE-ID CWE-592
Exploitation vector Network
Public exploit N/A
Vulnerable software
 Debian Linux
Operating systems & Components / Operating system

Vendor Debian

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Authentication bypass

EUVDB-ID: #VU9424

Risk: Low

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-8028

CWE-ID: CWE-592 - Authentication Bypass Issues

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass authentication on the target system.

The weakness exists due to some LDAP vendors require an explicit operation for the LDAP bind to take effect. A remote attacker with knowledge of the username can authenticate with an arbitrary password when connected to some LDAP servers, when no additional attributes are bound, and when using LDAP BindAuthenticator with org.springframework.ldap.core.support.DefaultTlsDirContextAuthenticationStrategy as the authentication strategy, and setting userSearch.

Mitigation

Update the affected package to version: 1.3.1.RELEASE-5+deb8u1

Vulnerable software versions

Debian Linux: All versions

CPE2.3 External links

https://pivotal.io/security/cve-2017-8028


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###