Secunia

Alexander Gerasiov has reported a security issue in phpLDAPadmin, which can be exploited by malicious people to bypass certain security restrictions.

The security issue is caused due to an error in login.php when validating whether anonymous bind has been disabled in the configuration. This can be exploited to access the LDAP server anonymously, even if anonymous bind has been disabled in the configuration with the "disable_anon_bind" statement.

The security issue has been reported in 0.9.6c. Other versions may also be affected.

Solution
The vulnerability has been fixed in version 0.9.7-alpha6.

Provided and/or discovered by
Alexander Gerasiov

Changelog
Further details available in Customer Area

Original Advisory
Debian:
http://www.debian.org/security/2005/dsa-790

Deep Links
Links available in Customer Area