[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: OpenLDAP 2.3.35 available

OpenLDAP Project wrote: 
OpenLDAP 2.3.35 is now available for download as detailed
on our download page:
   http://www.openldap.org/software/download/

and should soon be available on all official mirrors:
   ftp://ftp.openldap.org/pub/OpenLDAP/MIRRORS

This is a maintenance release and is made available for
general use.  Users of OpenLDAP Software are encouraged
to upgrade.

Significant contributors to this release include:
   Quanah Gibson-Mount (Stanford)
   Pierangelo Masarati (SysNet)
   Howard Chu (Symas)

-- The OpenLDAP Project


OpenLDAP 2.3.35 Release (2007/04/09)
     Fixed ldapmodify to use correct memory free functions (ITS#4901)
     Fixed slapd acl set minor typo (ITS#4874)
     Fixed slapd entry consistency check in str2entry2 (ITS#4852)
     Fixed slapd ldapi:// credential issue (ITS#4893)


ITS#4893 addresses security implications on HPUX. If you're using
ldapi:// on HPUX 11 it is possible for regular users to bind to the
directory with the credentials of Unix root. Similar exploits may be
possible on AIX 5.1 and older, and Solaris 2.9 and older. This release
disables the insecure credential passing mechanism on these OS versions;
if you were relying on SASL/EXTERNAL authentication with ldapi:// on the
affected platforms that mechanism will no longer work after you install
this release.

We may re-enable these mechanisms in a later update, depending on user
demand. In the meantime, if you're using ldapi:// on these platforms,
you need to stop or upgrade to this release ASAP. Workarounds are still
being tested and will be made available as they become ready.

--
   -- Howard Chu
   Chief Architect, Symas Corp.  http://www.symas.com
   Director, Highland Sun        http://highlandsun.com/hyc/
   Chief Architect, OpenLDAP     http://www.openldap.org/project/