webproxy: LDAP bind password passed on basic_ldap_auth command line
In progress, HighPublicBUG
Actions

Assigned To

Authored By

	natali-rs1985
	Tue, Nov 3, 11:46 AM

Description

The squid LDAP bind password is passed to basic_ldap_auth on its command line.

Problem
-w "<password>" is visible in /proc/*/cmdline to every user; -W <file> is available and unused.

Impact
Directory service credential disclosed to all local users.

Suggested fix
Write the password to a 0600 file and use -W.

natali-rs1985 changed the task status from Open to In progress.

natali-rs1985 claimed this task.

natali-rs1985 triaged this task as High priority.