CVE-2005-3532 — courier - programming error

描述

authpam.c in courier-authdaemon for Courier Mail Server 0.37.3 through 0.52.1, when using pam_tally, does not call the pam_acct_mgmt function to verify that access should be granted, which allows attackers to authenticate to the server using accounts that have been disabled.

如何修補 CVE-2005-3532

要修補 CVE-2005-3532,請將受影響套件升級到下列已修補版本。

Debian/courier—升級至 0.47-12 或更新版本
Debian/courier—升級至 0.37.3-2.8 或更新版本

CVE-2005-3532 正在被利用嗎?

低 — EPSS 為 1.6%,目前沒有觀察到大規模利用活動。

受影響套件(2)

from 0, < 0.47-12
from 0, < 0.37.3-2.8

參考連結(1)

ADVISORYsecurity-tracker.debian.org/tracker/CVE-2005-3532