Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm just setting up a new openLDAP server for user authentification and stumbled over the access control statements in the serverguide. In especially:

access to * by self write ...

As the access to the "uidNumber" attribute isn't prohibited by a previous statement, this allows any user with an LDAP account to change their "uidNumber" to 0 (root) and login using their default credentials and become root (or someone else). At least this is possible on my setup, with this ACLs.

Am I missing something?

share|improve this question

closed as off topic by Jorge Castro, Mitch, Amith KK, Anwar Shah, con-f-use Oct 16 '12 at 12:20

Questions on Ask Ubuntu are expected to relate to Ubuntu within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

This is an excellent question ...but since Ask Ubuntu is not the place for bug reports, if it turns out that this is a security hole, then you should report it as a security bug in Ubuntu (against the server guide itself, not against LDAP). – Eliah Kagan Jun 17 '12 at 2:13

Browse other questions tagged or ask your own question.