PT-2005-4325 · Courier · Courier-Authdaemon

Patrick Cheong Shu Yang · Publicado 2005-12-11 · Atualizado 2018-10-03 · CVE-2005-3532

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions courier-authdaemon versions 0.37.3 through 0.52.1

Description The issue is related to the authentication process in courier-authdaemon. When using pam tally, the pam acct mgmt function is not called to verify if access should be granted. This allows attackers to authenticate to the server using accounts that have been disabled.

Recommendations For versions 0.37.3 through 0.52.1, update to a version that includes the fix for this issue, ensuring that the pam acct mgmt function is properly called to verify account status before granting access.

Correção

Identificadores relacionados

CVE-2005-3532

DSA-917-1

Produtos afetados

Courier-Authdaemon

Referências · 11

• https://security-tracker.debian.org/tracker/CVE-2005-3532 · Aviso do Fabricante
• http://secunia.com/advisories/17919 · Aviso do Fabricante
• https://usn.ubuntu.com/226-1 · Aviso do Fabricante
• http://securityfocus.com/bid/15771 · Correção
• http://debian.org/security/2005/dsa-917 · Correção, Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/23532 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2005-3532 · Aviso do Fabricante
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=211920 · Correção
• http://secunia.com/advisories/17999 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-3532 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2005-3532 · Aviso do Fabricante