vbscript, ADSI Security Issue

ADSI Security Issue

Author	Message
Sami #1 / 3	ADSI Security Issue Hello All, I hope that I reached the right newsgroup. My question is about ADSI security. Check the following simple ASP script <% Set objDomain = GetObject("WinNT://MyHost") Response.Write objDomain.Schema For each objUser In objDomain Response.Write " <LI> " & objUser.name Next %> This four lines code displays the users account information from any browser. This is a big security hole. Is there away to set ADSI USERS permission so we can fix this bug. Any comments Thank you
Mon, 30 Dec 2002 03:00:00 GMT

Will Fair #2 / 3	ADSI Security Issue It's not a bug. You have to write this script and place it on your server for the information to be displayed. Just limit access to the web/virtual directory containing this script using one of the many authentication methods. Quote: > Hello All, > I hope that I reached the right newsgroup. My question is about ADSI > security. Check the following simple ASP script > <% > Set objDomain = GetObject("WinNT://MyHost") > Response.Write objDomain.Schema > For each objUser In objDomain > Response.Write " <LI> " & objUser.name > Next > %> > This four lines code displays the users account information from any > browser. This is a big security hole. Is there away to set ADSI USERS > permission so we can fix this bug. > Any comments > Thank you
Tue, 31 Dec 2002 03:00:00 GMT

MS #3 / 3	ADSI Security Issue Quote: > This four lines code displays the users account information from any > browser. This is a big security hole. Is there away to set ADSI USERS > permission so we can fix this bug. Hi, I believe that anyone who logs on to an NT machine can enumerate all of the users of that machine. Since ASP logs on as IUSR_Machine (or the actual user if Anonymous access is turned off), it is quite likely to have this right. As the other post suggests, simply turn off anonymous access to the page. (Although as veterans of the group will tell you, I'm no security expert <g>) Peter -- Peter J. Torr - Microsoft Windows Script Program Manager Please do not e-mail me with questions - post them to this newsgroup instead. Thankyou!
Fri, 03 Jan 2003 03:00:00 GMT

Page 1 of 1

[ 3 post ]