Vulnerability Name:

CVE-2017-14623 (CCN-132379)

Assigned:2017-08-24
Published:2017-08-24
Updated:2019-10-03
Summary:In the ldap.v2 (aka go-ldap) package through 2.5.0 for Go, an attacker may be able to login with an empty password. This issue affects an application using this package if these conditions are met: (1) it relies only on the return error of the Bind function call to determine whether a user is authorized (i.e., a nil return value is interpreted as successful authorization) and (2) it is used with an LDAP server allowing unauthenticated bind.
CVSS v3 Severity:8.1 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
7.1 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
4.6 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:5.1 Medium (CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-287
Vulnerability Consequences:Bypass Security
References:Source: MITRE
Type: CNA
CVE-2017-14623

Source: XF
Type: UNKNOWN
ldap-cve201714623-sec-bypass(132379)

Source: CCN
Type: ldap GIT Repository
Merge pull request #126 from tiziano88/check_empty_password

Source: CONFIRM
Type: Patch, Third Party Advisory
https://github.com/go-ldap/ldap/commit/95ede1266b237bf8e9aa5dce0b3250e51bfefe66

Source: CONFIRM
Type: Patch, Third Party Advisory
https://github.com/go-ldap/ldap/pull/126

Source: CCN
Type: IBM Security Bulletin 6833248 (CICS TX Standard)
IBM CICS TX Standard is vulnerable to multiple vulnerabilities in Golang Go.

Source: CCN
Type: IBM Security Bulletin 6833250 (CICS TX Advanced)
IBM CICS TX Advanced is vulnerable to multiple vulnerabilities in Golang Go.

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2017-14623

Vulnerable Configuration:Configuration 1:
  • cpe:/a:go-ldap_project:ldap:*:*:*:*:*:*:*:* (Version <= 2.5.0)

    • Configuration CCN 1:
  • cpe:/a:ibm:cics_tx:11.1:*:*:*:standard:*:*:*
  • OR cpe:/a:ibm:cics_tx:11.1:*:*:*:advanced:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:com.ubuntu.artful:def:201714623000
    V
    		CVE-2017-14623 on Ubuntu 17.10 (artful) - medium.
    2017-09-20
    oval:com.ubuntu.bionic:def:201714623000
    V
    		CVE-2017-14623 on Ubuntu 18.04 LTS (bionic) - medium.
    2017-09-20
    oval:com.ubuntu.cosmic:def:201714623000
    V
    		CVE-2017-14623 on Ubuntu 18.10 (cosmic) - medium.
    2017-09-20
    oval:com.ubuntu.xenial:def:201714623000
    V
    		CVE-2017-14623 on Ubuntu 16.04 LTS (xenial) - medium.
    2017-09-20
    BACK
    go-ldap_project ldap *
    ibm cics tx 11.1
    ibm cics tx 11.1