[
https://issues.apache.org/jira/browse/DERBY-7147?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17629837#comment-17629837
]
Richard N. Hillegas commented on DERBY-7147:
--------------------------------------------
As a first step toward fixing this issue, I want to run the
LDAPAuthenticationTest. This test only runs when the user sets system
properties which identify a running LDAP server. Instructions for setting up an
LDAP server can be found at
https://db.apache.org/derby/docs/10.16/security/csecldapbooting.html and
redundantly in the security white paper at
https://www.oracle.com/technetwork/java/javadb/securitywhitepaper10-159253.pdf.
Unfortunately, the instructions refer to a web page which has disappeared:
https://community.oracle.com/hub/today/2007/03/22/secArticle.LDIF
> LDAP injection vulnerability in LDAPAuthenticationImpl
> ------------------------------------------------------
>
> Key: DERBY-7147
> URL: https://issues.apache.org/jira/browse/DERBY-7147
> Project: Derby
> Issue Type: Bug
> Components: JDBC
> Affects Versions: 10.16.1.1
> Reporter: Richard N. Hillegas
> Assignee: Richard N. Hillegas
> Priority: Major
>
> An LDAP injection vulnerability has been identified in
> LDAPAuthenticationSchemeImpl.getDNFromUID(). An exploit has not been
> provided, but there is a possibility that an intruder could bypass
> authentication checks in Derby-powered applications which rely on external
> LDAP servers.
> For more information on LDAP injection, see
> https://www.synopsys.com/glossary/what-is-ldap-injection.html
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
