CVE-2005-3532

2005-12-1101:03:00

[email protected]

web.nvd.nist.gov

cve-2005-3532

authpam.c

courier-authdaemon

courier mail server

pam_tally

pam_acct_mgmt

unauthorized access

nvd

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

6.4 Medium

AI Score

Confidence

Low

0.006 Low

EPSS

Percentile

79.0%

JSON

authpam.c in courier-authdaemon for Courier Mail Server 0.37.3 through 0.52.1, when using pam_tally, does not call the pam_acct_mgmt function to verify that access should be granted, which allows attackers to authenticate to the server using accounts that have been disabled.

Affected configurations

NVD

Node

double_precision_incorporatedcourier_mail_serverMatch0.37.3

double_precision_incorporatedcourier_mail_serverMatch0.46

double_precision_incorporatedcourier_mail_serverMatch0.47

double_precision_incorporatedcourier_mail_serverMatch0.48

double_precision_incorporatedcourier_mail_serverMatch0.48.1

double_precision_incorporatedcourier_mail_serverMatch0.48.2

double_precision_incorporatedcourier_mail_serverMatch0.49.0

double_precision_incorporatedcourier_mail_serverMatch0.50.0

double_precision_incorporatedcourier_mail_serverMatch0.52.1

CPENameOperatorVersion
double_precision_incorporated:courier_mail_serverdouble precision incorporated courier mail servereq0.37.3
double_precision_incorporated:courier_mail_serverdouble precision incorporated courier mail servereq0.46
double_precision_incorporated:courier_mail_serverdouble precision incorporated courier mail servereq0.47
double_precision_incorporated:courier_mail_serverdouble precision incorporated courier mail servereq0.48
double_precision_incorporated:courier_mail_serverdouble precision incorporated courier mail servereq0.48.1
double_precision_incorporated:courier_mail_serverdouble precision incorporated courier mail servereq0.48.2
double_precision_incorporated:courier_mail_serverdouble precision incorporated courier mail servereq0.49.0
double_precision_incorporated:courier_mail_serverdouble precision incorporated courier mail servereq0.50.0
double_precision_incorporated:courier_mail_serverdouble precision incorporated courier mail servereq0.52.1

CPE	Name	Operator	Version
double_precision_incorporated:courier_mail_server	double precision incorporated courier mail server	eq	0.37.3
double_precision_incorporated:courier_mail_server	double precision incorporated courier mail server	eq	0.46
double_precision_incorporated:courier_mail_server	double precision incorporated courier mail server	eq	0.47
double_precision_incorporated:courier_mail_server	double precision incorporated courier mail server	eq	0.48
double_precision_incorporated:courier_mail_server	double precision incorporated courier mail server	eq	0.48.1
double_precision_incorporated:courier_mail_server	double precision incorporated courier mail server	eq	0.48.2
double_precision_incorporated:courier_mail_server	double precision incorporated courier mail server	eq	0.49.0
double_precision_incorporated:courier_mail_server	double precision incorporated courier mail server	eq	0.50.0
double_precision_incorporated:courier_mail_server	double precision incorporated courier mail server	eq	0.52.1