CVE-2005-3532: High severity Double Precision Incorporated Courier Mail Server vulnerability
Published Dec 11, 2005
·Updated
authpam.c in courier-authdaemon for Courier Mail Server 0.37.3 through 0.52.1, when using pamtally, does not call the pamacctmgmt function to verify that access should be granted, which allows attackers to authenticate to the server using accounts that have been disabled.
Affected Software
9 affected components
Double Precision Incorporated Courier Mail Server=0.37.3
Double Precision Incorporated Courier Mail Server=0.46
Double Precision Incorporated Courier Mail Server=0.47
Double Precision Incorporated Courier Mail Server=0.48
Double Precision Incorporated Courier Mail Server=0.48.1
Double Precision Incorporated Courier Mail Server=0.48.2
Double Precision Incorporated Courier Mail Server=0.49.0
Double Precision Incorporated Courier Mail Server=0.50.0
Double Precision Incorporated Courier Mail Server=0.52.1
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Dec 11, 2005
CVE Published
01:03 AM
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2005-3532?
CVE-2005-3532 is classified as a medium severity vulnerability.
2
How do I fix CVE-2005-3532?
To fix CVE-2005-3532, upgrade Courier Mail Server to version 0.53 or later.
3
What systems are affected by CVE-2005-3532?
CVE-2005-3532 affects Courier Mail Server versions from 0.37.3 to 0.52.1 that use pam_tally.
4
What type of vulnerability is CVE-2005-3532?
CVE-2005-3532 is an authentication vulnerability that allows disabled accounts to be used for login.
5
Can I still use Courier Mail Server if it's affected by CVE-2005-3532?
It is not recommended to use Courier Mail Server with CVE-2005-3532, as it poses a security risk until patched.