To print: Click here or Select File and then Print from your browser's menu

This story was printed from silicon.com, located at http://www.silicon.com/

Story URL: http://software.silicon.com/security/0,39024655,11025798,00.htm

LDAP blues: Server weakness throws up security fears
Denial-of-service threat revealed...

By Sally Watson

Published: Tuesday 17 July 2001

Researchers have uncovered a vulnerability in LDAP (lightweight directory access protocol) which has left thousands of web servers open to email bombardment by malicious attackers.

According to the CERT security team at Carnegie Mellon University, the flaw leaves servers open to denial-of-service (DoS) attacks and enables unauthorised access from outside the network.

The University of California estimates some 5,000 DoS attacks take place every week.

LDAP is a simple and widely used protocol enabling companies to access and search directories of names, phone numbers, addresses stored on a variety of incompatible systems.

Users running versions of IBM SecureWay, iPlanet Directory Server, Lotus Domino R5 Server, Network Associates' PGP Keyserver, Microsoft Exchange 5.5 LDAP Service, OpenLDAP, Oracle 8i Enterprise Edition, Qualcomm Eudora mail program and Teamware Office are at risk.