#553165 icedove: offline replication of LDAP address book uses anonymous bind

Package:
icedove
Source:
thunderbird
Submitter:
Tollef Fog Heen
Date:
2023-04-26 10:30:06 UTC
Severity:
normal
#553165#5
Date:
2009-10-29 10:53:12 UTC
From:
To:
It seems like the «Download addressbook for offline use» is using
anonymous binds rather than prompting for a password.

Server-side, it looks like:
Oct 29 11:50:05 phaal slapd[17385]: conn=24 fd=23 ACCEPT from IP=78.86.233.73:59038 (IP=0.0.0.0:636)
Oct 29 11:50:05 phaal slapd[17385]: conn=24 fd=23 TLS established tls_ssf=256 ssf=256
Oct 29 11:50:05 phaal slapd[17385]: conn=24 op=0 BIND dn="" method=128
Oct 29 11:50:05 phaal slapd[17385]: conn=24 op=0 RESULT tag=97 err=48 text=anonymous bind disallowed
Oct 29 11:50:05 phaal slapd[17385]: conn=24 op=1 UNBIND
Oct 29 11:50:05 phaal slapd[17385]: conn=24 fd=23 closed

To reproduce, set up slapd with «disallow bind_anon» and then try to
download an address book for offline use.