3 ms·
This is only an issue when binding to an OpenLDAP server. There may be additional issues with LDAP on Lion server, but this problem as reported is an issue with
by a2tech 15y ago
This is only an issue when binding to an OpenLDAP server. There may be additional issues with LDAP on Lion server, but this problem as reported is an issue with Lion clients bound to servers running OpenLDAP without Kerberos or SSL.
- matsur 15y agoYour use of the word "only" here is misplaced. This is a very serious security issue that affects clients connecting to OpenLDAP.
- a2tech 15y agoIndeed-for users that are bound to OpenLDAP its a massive issue. Without knowing those users exact setup its hard to know exactly what the issue is-the fact that its ONLY OpenLDAP servers is odd. The client must be receiving some sort of authentication succeeded message (you will note that it won't accept a blank password-so in that case OpenLDAP is responding with a failure). It may be a bug in Lion that triggers a bug in OpenLDAP.
- marshray 15y agoIt may also be possible for an attacker to impersonate an OpenLDAP server in order to induce (and exploit) the behavior.
- niels_olson 15y agowhich is possibly quite a few university macs in libraries and computer labs.
- wtallis 15y agoReally? Can you name even one university that uses LDAP but not Kerberos for their computer labs?
- niels_olson 15y agoWell, I could name one that almost certainly doesn't, but I'll refrain.
- a2tech 15y agoIn the Universities I've worked with, or visited, the computers in the labs (Macs anyway) have all been using Kerberos in one fashion or another-AD uses Kerberos, so does OpenDirectory (OS X directory offering).