I'm just setting up a new openLDAP server for user authentification and stumbled over the access control statements in the serverguide. In especially:
access to * by self write ...
As the access to the "uidNumber" attribute isn't prohibited by a previous statement, this allows any user with an LDAP account to change their "uidNumber" to 0 (root) and login using their default credentials and become root (or someone else). At least this is possible on my setup, with this ACLs.
Am I missing something?
