[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: large ldap server recommendation

--On Friday, February 01, 2008 12:46 PM -0600 Brad Knowles <b.knowles@its.utexas.edu> wrote:

Quanah Gibson-Mount wrote:

If your 2.3.35 servers can be accessed via a remote connection, anyone
can crash them at any time.  Is that considered critical?

Out of curiosity, can you point me at specific weaknesses in 2.3.35 that we should be concerned about? Are we talking about ITS#s 4923, 4925, 4938, 4966, or something else?

Is this something where they could only crash the server if they could
get direct access to send malformed LDAP queries, or is this something
that could potentially be abused through a third-party XSS-style attack?

There were a lot of bugs in 2.3.35, but basically if someone can send a query to the server, regardless of anonymous vs auth, they can crash it.

It is ITS#5119.



Quanah Gibson-Mount
Principal Software Engineer
Zimbra, Inc
Zimbra ::  the leader in open source messaging and collaboration