Re: large ldap server recommendation

[Quanah Gibson-Mount <quanah@zimbra.com>]

--On Friday, February 01, 2008 12:46 PM -0600 Brad Knowles 
<b.knowles@its.utexas.edu> wrote:

> Quanah Gibson-Mount wrote:
>
> > If your 2.3.35 servers can be accessed via a remote connection, anyone
> > can crash them at any time.  Is that considered critical?
>
> Out of curiosity, can you point me at specific weaknesses in 2.3.35 that
> we should be concerned about?  Are we talking about ITS#s 4923, 4925,
> 4938, 4966, or something else?
>
> Is this something where they could only crash the server if they could
> get direct access to send malformed LDAP queries, or is this something
> that could potentially be abused through a third-party XSS-style attack?

There were a lot of bugs in 2.3.35, but basically if someone can send a 
query to the server, regardless of anonymous vs auth, they can crash it.

It is ITS#5119.

--Quanah



--

Quanah Gibson-Mount
Principal Software Engineer
Zimbra, Inc
--------------------
Zimbra ::  the leader in open source messaging and collaboration