Guess it depends on your environment. In a university where you can
depend
on having an abundance of users with malicious intent and too much
time on
their hands, such exploits are common place. In a business, OTOH,
where you
have limited administrative resources and the LDAP server needs to be
a functional unit, not a hobby/project, a precompiled working server is
often very desirable, even with a few bugs as you describe. Sure, the
latest
greatest stable CVS release is desirable, but, compiling openLDAP from
scratch
is not for the timid. It has gotten better, but, between the large list
of documented dependencies and the not-so-well-documented dependencies
of those packages, it can take quite a bit of effort to get to the point
where you can actually build OpenLDAP. Then, the myriad configure
options
required just to get an installable SLAPD can take a fair amount of time
to digest.
In a lot of instances, it's well worth the time tradeoff to just accept
that although a bit behind, the Fedora team has taken care of building
the
things most people need into a working slapd in a precompiled package
with
a reasonable default slapd.conf.
Again, YMMV, but, it is very clear to me that a lot of the LDAP community
just sort of seems to assume that everyone has infinite time to invest in
dealing with LDAP. This simply isn't the case in the real world.