Detections
Analytics

LDAP NULL BASE Search Access

medium Nessus Plugin ID 10722

Language:

Synopsis

The remote LDAP server may disclose sensitive information.

Description

The remote LDAP server supports search requests with a NULL, or empty, base object. This allows information to be retrieved without any prior knowledge of the directory structure. Coupled with a NULL BIND, an anonymous user may be able to query your LDAP server using a tool such as 'LdapMiner'.

Note that there are valid reasons to allow queries with a NULL base.
For example, it is required in version 3 of the LDAP protocol to provide access to the root DSA-Specific Entry (DSE), with information about the supported naming context, authentication types, and the like. It also means that legitimate users can find information in the directory without any prior knowledge of its structure. As such, this finding may be a false-positive.

Solution

If the remote LDAP server supports a version of the LDAP protocol before v3, consider whether to disable NULL BASE queries on your LDAP server.

See Also

https://support.microsoft.com/en-us/help/837964

Plugin Details

Severity: Medium

ID: 10722

File Name: ldap_null_base.nasl

Version: 1.29

Type: remote

Family: Misc.

Published: 8/13/2001

Updated: 8/28/2023

Supported Sensors: Nessus

Risk Information

CVSS Score Rationale: Information disclosure vulnerability

CVSS v2

Risk Factor: Medium

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: manual