<story><title>Mac OS X Lion accepts any password when authenticating via LDAP</title><url>http://forums.macrumors.com/showthread.php?t=1197379</url><text></text></story><parent_chain><item><author>tptacek</author><text>Not many people in the security community use Mac servers in such a way that they need LDAP, and of those people, very few are running Lion on their servers.</text></item><item><author>fredoliveira</author><text>This looks both real and a pretty serious issue (I wonder how it went by almost a month without getting picked up by the security community). There&apos;s an discussion about it on Apple&apos;s own forums, linked below, but the gist of it is that users can authenticate over LDAP using any password using the login screen, and can&apos;t authenticate at all using su:&lt;p&gt;&lt;a href=&quot;https://discussions.apple.com/message/15887083&quot; rel=&quot;nofollow&quot;&gt;https://discussions.apple.com/message/15887083&lt;/a&gt;</text></item></parent_chain><comment><author>Sidnicious</author><text>I wasn&apos;t entirely clear from the link — Are Lion &lt;i&gt;servers&lt;/i&gt; not being picky about passwords, or are Lion &lt;i&gt;clients&lt;/i&gt; not being picky about LDAP authentication failing (hence not being able to mount the user&apos;s home folder)?&lt;p&gt;If the latter, the impact is bad, but not as bad (you&apos;ll be able to get access to the machine you&apos;re sitting at, but not to any server-side resources).</text></comment>
<story><title>Mac OS X Lion accepts any password when authenticating via LDAP</title><url>http://forums.macrumors.com/showthread.php?t=1197379</url><text></text></story><parent_chain><item><author>tptacek</author><text>Not many people in the security community use Mac servers in such a way that they need LDAP, and of those people, very few are running Lion on their servers.</text></item><item><author>fredoliveira</author><text>This looks both real and a pretty serious issue (I wonder how it went by almost a month without getting picked up by the security community). There&apos;s an discussion about it on Apple&apos;s own forums, linked below, but the gist of it is that users can authenticate over LDAP using any password using the login screen, and can&apos;t authenticate at all using su:&lt;p&gt;&lt;a href=&quot;https://discussions.apple.com/message/15887083&quot; rel=&quot;nofollow&quot;&gt;https://discussions.apple.com/message/15887083&lt;/a&gt;</text></item></parent_chain><comment><author>perlgeek</author><text>Wouldn&apos;t Mac &lt;i&gt;clients&lt;/i&gt; need LDAP for authentification too?</text></comment>