PT-2005-4325 · Courier · Courier-Authdaemon

Patrick Cheong Shu Yang · Published 2005-12-11 · Updated 2018-10-03 · CVE-2005-3532

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions courier-authdaemon versions 0.37.3 through 0.52.1

Description The issue is related to the authentication process in courier-authdaemon. When using pam tally, the pam acct mgmt function is not called to verify if access should be granted. This allows attackers to authenticate to the server using accounts that have been disabled.

Recommendations For versions 0.37.3 through 0.52.1, update to a version that includes the fix for this issue, ensuring that the pam acct mgmt function is properly called to verify account status before granting access.

Fix

Related Identifiers

CVE-2005-3532

DSA-917-1

Affected Products

Courier-Authdaemon

References · 11

• https://security-tracker.debian.org/tracker/CVE-2005-3532 · Vendor Advisory
• http://secunia.com/advisories/17919 · Vendor Advisory
• https://usn.ubuntu.com/226-1 · Vendor Advisory
• http://securityfocus.com/bid/15771 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2005-3532 · Vendor Advisory
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=211920 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2005-3532 · Security Note
• https://osv.dev/vulnerability/CVE-2005-3532 · Vendor Advisory
• http://debian.org/security/2005/dsa-917 · Patch, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/23532 · Note
• http://secunia.com/advisories/17999 · Note