The core server component in PostgreSQL 8.3 before 8.3.8 and 8.2 before 8.2.14 when using LDAP authentication with anonymous binds allows remote attackers to bypass authentication via an empty password.