Re: CVE request / advisory: Cherokee

[cve-assign () mitre org]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

For reference, here is the URL mentioned on this list during the last
discussion of a CVE assignment related to LDAP and an empty string:

  http://securitysynapse.blogspot.ca/2013/09/dangers-of-ldap-null-base-and-bind.html

The Cherokee vulnerability here is essentially a misinterpretation of
an LDAP server response. Cherokee should be expecting the semantics:

  - If I send a username and a non-empty password, a successful bind means
    that that's the correct password for the user

  - If I send a username and an empty password, a successful bind means
    that (A) that's not the correct password for the user and (B)
    the LDAP server probably happens to allow unauthenticated information
    retrieval that might or might not be intentional

Instead, Cherokee incorrectly assumes that the semantics are:

  - If I send a username and any password (empty or non-empty), a
    successful bind means that that's the correct password for the user

Use CVE-2014-4668.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)

iQEcBAEBAgAGBQJTrsWJAAoJEKllVAevmvms4xsH/2Mp62a/D0Sfnbj2xFBCkt6I
fz/F0zC9Vue06vegJ/liSMJvpcJOxdO60lm1pEYAEXMdwM4OcewZ8+kRYhzCvOlf
ibEZlIi6YSh9AceI34NxGTzqhh2yVFApdm7uEdItr+ZT9g4uNejtjUdU+wQN5Ozx
8I4RJ5eYZPYNfrvru0RqvYW7iUOW2FG9nibhfZRSQ2NvsoJKXgMlz4GvknjqEijt
Mv0cyZ1PSNopcGcfdjyz568fEBy+0HWaEkx9EnQq1ni757B5D2iycSjleWsBRrgi
vQMOtmOEvVIC1RCVZuy8ZuTUIY8Lnfxxwmr7W+KjmiXtr2lUUhUZWHnM4s9d9bY=
=ukMd
-----END PGP SIGNATURE-----