Design/Logic Flaw

Dovecot before 1.0.10, with certain configuration options including use of %variables, does not properly maintain the LDAP+auth cache, which might allow remote authenticated users to login as a different user who has the same password...

CVE-2007-6598

Dovecot before 1.0.10, with certain configuration options including use of %variables, does not properly maintain the LDAP+auth cache, which might allow remote authenticated users to login as a different user who has the same password...

DEBIAN-CVE-2007-6598

Dovecot before 1.0.10, with certain configuration options including use of %variables, does not properly maintain the LDAP+auth cache, which might allow remote authenticated users to login as a different user who has the same password...

CVE-2007-6598

Dovecot before 1.0.10, with certain configuration options including use of %variables, does not properly maintain the LDAP+auth cache, which might allow remote authenticated users to login as a different user who has the same password...

CVE-2007-6598

Dovecot before 1.0.10, with certain configuration options including use of %variables, does not properly maintain the LDAP+auth cache, which might allow remote authenticated users to login as a different user who has the same password...

CVE-2007-6598

Dovecot before 1.0.10, with certain configuration options including use of %variables, does not properly maintain the LDAP+auth cache, which might allow remote authenticated users to login as a different user who has the same password...

CVE-2007-6598

CVE-2007-6598 affects Dovecot (IMAP/POP3 server). The issue, described as a flaw in the LDAP+auth cache handling, can allow remote authenticated users to log in as a different user who has the same password when certain configuration options (including use of %variables) are enabled. Affected rel...

CVE-2007-6598

Dovecot before 1.0.10, with certain configuration options including use of %variables, does not properly maintain the LDAP+auth cache, which might allow remote authenticated users to login as a different user who has the same password...

Dovecot password caching vulnerability

Under some conditions user can be logged with different account with same password...

FreeBSD : dovecot -- Specific LDAP + auth cache configuration may mix up user logins (cf484358-b5d6-11dc-8de0-001c2514716c)

Dovecot reports : If two users with the same password and same passfilter variables log in within authcachettl seconds 1h by default, the second user may get logged in with the first user's cached passattrs. For example if passattrs contained the user's home/mail directory, this would mean that t...

dovecot -- Specific LDAP + auth cache configuration may mix up user logins

Dovecot reports: If two users with the same password and same passfilter variables log in within authcachettl seconds 1h by default, the second user may get logged in with the first user's cached passattrs. For example if passattrs contained the user's home/mail directory, this would mean that th...

[SECURITY] [DSA 1430-1] New libnss-ldap packages fix denial of service

------------------------------------------------------------------------ Debian Security Advisory DSA-1430-1 [email protected] http://www.debian.org/security/ Steve Kemp December 11, 2007 http://www.debian.org/security/faq -...

DSA-1430-1 libnss-ldap - information disclosure

Bulletin has no description...

nss_ldap: Information disclosure

Background nssldap is a Name Service Switch module which allows 'passwd', 'group' and 'host' database information to be pulled from LDAP. Description Josh Burley reported that nssldap does not properly handle the LDAP connections due to a race condition that can be triggered by multi-threaded...

CVE-2007-5794

Race condition in nssldap, when used in applications that are linked against the pthread library and fork after a call to nssldap, might send user data to the wrong process because of improper handling of the LDAP connection. NOTE: this issue was originally reported for Dovecot with the wrong...

CVE-2007-5794

Race condition in nssldap, when used in applications that are linked against the pthread library and fork after a call to nssldap, might send user data to the wrong process because of improper handling of the LDAP connection. NOTE: this issue was originally reported for Dovecot with the wrong...

CVE-2007-5794

Race condition in nssldap, when used in applications that are linked against the pthread library and fork after a call to nssldap, might send user data to the wrong process because of improper handling of the LDAP connection. NOTE: this issue was originally reported for Dovecot with the wrong...

CVE-2007-5794

Race condition in nssldap, when used in applications that are linked against the pthread library and fork after a call to nssldap, might send user data to the wrong process because of improper handling of the LDAP connection. NOTE: this issue was originally reported for Dovecot with the wrong...

Ubuntu 6.06 LTS / 6.10 / 7.04 : dovecot vulnerability (USN-487-1)

It was discovered that Dovecot, when configured to use non-system-user spools and compressed folders, would allow directory traversals in mailbox names. Remote authenticated users could potentially read email owned by other users. Note that Tenable Network Security has extracted the preceding...

Ubuntu 6.06 LTS : dovecot regression (USN-288-4)

USN-288-3 fixed a vulnerability in dovecot. Unfortunately the Ubuntu 6.06 update had a regression which caused authentication using a MySQL database to not work any more. This update fixes this again. We apologize for the inconvenience. Note that Tenable Network Security has extracted the precedi...