full-disclosure - LDAP username special char Problem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

From: Jakob.Jellbauer at interhyp.de (Jellbauer Jakob)
Subject: LDAP username special char Problem

Hi,

today i followed this scenario:

a user tried to connect to Windows 2000 ActiveDirectory trough LDAP, and misspelled the loginname like :

us?rname or us?rname  (with special char like  `  or ^ or  ? )

and is succesfully connected ! 

is this a known "feature" or problem ?

i reproduced it with php ldap functions and with Softerra LDAP Browser 

greetings

jakob




Jakob Jellbauer
Junior Network & Systemadministrator
Interhyp AG
Parkstadt Schwabing
Marcel-Breuer-Stra?e 18
80807 M?nchen
fon: +49 (89) 76 77 21 47
fax: +49 (89) 76 77 251 47
mailto:jakob.jellbauer@...erhyp.de
http://www.interhyp.de