AS/400 LDAP user accounts disclosure

["Shalom Carmel" <shalom () venera com>]

AS/400 LDAP user accounts disclosure

Overview
-------------
By default, a new iSeries server comes with a pre-installed directory
server,better known as an LDAP server.LDAP, or Lightweight
Directory Access Protocol, is the industry standard for enterprise
directory services, and forms the basis for many common directory
applications such as Microsoft Active Directory,iPlanet directory,
Oracle OID and others. On the AS400,this pre-installed service is
turned on by default, although it is not necessary for the regular
operations of the AS/400 server.
The LDAP service can be used to enumerate the AS400 user profiles.

The problem
----------------
The AS400 system projected backend has the ability to map OS/400
objects as entries within the LDAP-accessible directory tree.
The projected objects are LDAP representations of OS/400 objects
instead of actual entries stored in the LDAP server database.
So far, OS/400 user profiles are the only objects
being mapped or projected as entries within the directory tree.
It is sufficient to retrieve the list of users with an LDAP search.
To conduct such a search, you need any valid AS/400 account.
The LDAP search ability is not dependant on any restrictions or
special permissions the user may have.
The search returns information about user profiles that are in the
same group like the account we use for the exploit, and this situation
is common enough in the legacy applications world.


Vulnerable versions:
------------------------
OS400 version 5.2 and up.

Workaround
----------------
Turn LDAP off. You probably do not need it.


References
http://publib.boulder.ibm.com/iseries/v5r2/ic2924/info/rzahy/rzahyldapops.htm


For full details and sample code please read the PDF file found at
http://www.venera.com/downloads

Shalom Carmel