CVE-2005-3532

published 2005-12-11

CVE-2005-3532: authpam.c in courier-authdaemon for Courier Mail Server 0.37.3 through 0.52.1, when using pam_tally, does not call the pam_acct_mgmt function to verify that…

Priority P4 27 high 7.5 CVSS 2.0

AV N AC L Au N C P I P A P

authpam.c in courier-authdaemon for Courier Mail Server 0.37.3 through 0.52.1, when using pam_tally, does not call the pam_acct_mgmt function to verify that access should be granted, which allows attackers to authenticate to the server using accounts that have been disabled.

Affected

14 ranges

Vendor	Product	Version range	Fixed in
debian	courier	< courier 0.47-12 (bookworm)	courier 0.47-12 (bookworm)
double_precision_incorporated	courier_mail_server	—	—
double_precision_incorporated	courier_mail_server	—	—
double_precision_incorporated	courier_mail_server	—	—
double_precision_incorporated	courier_mail_server	—	—
double_precision_incorporated	courier_mail_server	—	—
double_precision_incorporated	courier_mail_server	—	—
double_precision_incorporated	courier_mail_server	—	—
double_precision_incorporated	courier_mail_server	—	—
double_precision_incorporated	courier_mail_server	—	—
double_precision_incorporated	courier_mail_server	>= 0 < 0.47-12	0.47-12
double_precision_incorporated	courier_mail_server	>= 0 < 0.47-12	0.47-12
double_precision_incorporated	courier_mail_server	>= 0 < 0.47-12	0.47-12
double_precision_incorporated	courier_mail_server	>= 0 < 0.47-12	0.47-12

CVSS provenance

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

osv 7.5 HIGH

vendor_debian 7.5 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.