Login without password possible?! Security issue!!!

[Remco_H]

Hello people,
We're running SIT 3.50 wih LDAP authentication (Novell edir).

BIG problem that i discovered is that i can login without password on any user accept for admin... With password I can login on the SIT system, wrong password isn't accepted, but leave the password blank I can login in every user (accept admin) on the SIT system.
I've just find out this morning, because I never tried to login without password. But is there anyone who also has this problem???

With kind regards,
Remco

[lee.todis]

I can confirm this. I can login in the same scenario. If I enter a wrong password, then I cannot login, but blank password and I am in as well.

Yeah, this is a huge problem. I even tried it with a machine that has no caching on it.

Someone???

[ivanlucas]

Hi Guys,

I've logged this as a bug (1047) and given it the highest priority, I'm not in a position to test this right this moment since I don't have a directory here with me but as you say it's potentially a huge issue.

Since this is so serious, if you want an immediate work-around to make your systems safe you can insert the following line of code into your lib/functions.inc.php file at line 152 (assuming you're running v3.50)

Code: Select all

if (empty($password)) return false;

This will ensure it's never possible to login with an empty password. A proper fix will be included with 3.51 after we've had time to investigate this properly.

Thanks for reporting this! Wow what a shocker.

All the best,

Ivan

[paulheaney]

Hi,

After some testing this appears to be caused how now eDirectory (and possibly other directories) handle binds without a password (as anonymous) thus SiT sees a successful auth and lets you in.

In 3.51 we now enforce a username AND a password a patch is available at http://bugs.sitracker.org/file_download ... 5&type=bug and the full patched functions.inc.php is available at http://bugs.sitracker.org/file_download ... 6&type=bug

Paul

[paulheaney]

Hi,

Patch for this issue is here as well, if you change to <sit root>/lib and run "patch < bug1047.diff"

Any problems let me know.

Cheers
Paul

[lee.todis]

Patch applied and tested.

Works as intended now, cannot login without password now.

Thank you for the FAST work!!

[Remco_H]

Hello,
Applied the patch to, is working fine now. Thanks for the fast responses and patch work!!!!

Regards,
Remco

[paulheaney]

Hi Remco,

Glad the fix worked for you as well.

Cheers
Paul