Alexander Gerasiov has reported a security issue in phpLDAPadmin, which can be exploited by malicious people to bypass certain security restrictions.
The security issue is caused due to an error in login.php when validating whether anonymous bind has been disabled in the configuration. This can be exploited to access the LDAP server anonymously, even if anonymous bind has been disabled in the configuration with the "disable_anon_bind" statement.
The security issue has been reported in 0.9.6c. Other versions may also be affected.
Solution: The vulnerability has been fixed in version 0.9.7-alpha6.
Provided and/or discovered by: Alexander Gerasiov
Original Advisory: Debian:
Do you have additional information related to this advisory?
Please provide information about patches, mitigating factors, new versions, exploits, faulty patches, links, and other relevant data by posting comments to this Advisory. You can also send this
information to firstname.lastname@example.org