AS/400 LDAP user accounts disclosure Overview ------------- By default, a new iSeries server comes with a pre-installed directory server,better known as an LDAP server.LDAP, or Lightweight Directory Access Protocol, is the industry standard for enterprise directory services, and forms the basis for many common directory applications such as Microsoft Active Directory,iPlanet directory, Oracle OID and others. On the AS400,this pre-installed service is turned on by default, although it is not necessary for the regular operations of the AS/400 server. The LDAP service can be used to enumerate the AS400 user profiles. The problem ---------------- The AS400 system projected backend has the ability to map OS/400 objects as entries within the LDAP-accessible directory tree. The projected objects are LDAP representations of OS/400 objects instead of actual entries stored in the LDAP server database. So far, OS/400 user profiles are the only objects being mapped or projected as entries within the directory tree. It is sufficient to retrieve the list of users with an LDAP search. To conduct such a search, you need any valid AS/400 account. The LDAP search ability is not dependant on any restrictions or special permissions the user may have. The search returns information about user profiles that are in the same group like the account we use for the exploit, and this situation is common enough in the legacy applications world. Vulnerable versions: ------------------------ OS400 version 5.2 and up. Workaround ---------------- Turn LDAP off. You probably do not need it. References http://publib.boulder.ibm.com/iseries/v5r2/ic2924/info/rzahy/rzahyldapops.htm For full details and sample code please read the PDF file found at http://www.venera.com/downloads Shalom Carmel