Re: IETF ldapbis WG Last Call: draft-ietf-ldapbis-user-schema-05.txt

["Kurt D. Zeilenga" <Kurt@OpenLDAP.org>]

At 12:40 PM 5/26/2003, Michael Ströder wrote:
>Kurt D. Zeilenga wrote:
>>KurtZ raised a security consideration regarding session hijacking.
>>Add consideration.
>
>???
>
>I can only find a this comment in mailing list archive:

The comment was raised in "the laundry list".
  http://www.openldap.org/lists/ietf-ldapbis/200305/msg00084.html

>"Add: Use of integrity protection is encouraged to prevent session hijacking."
>
>Which session is meant here?

The LDAP session.

If one uses a mechanism such as DIGEST-MD5 without
negotiating integrity protection to authenticate,
a man-in-middle can hijack the session after
authentication completes.