kpriv/freebsd-ports
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Document dovecot specific LDAP + auth cache configuration may mix up user logins vulnerability

Browse source
This commit is contained in:
Xin LI 2007-12-30 09:35:29 +00:00
parent a3db5153c2
commit d56109a32d
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=204698
1 changed files with 30 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

30
security/vuxml/vuln.xml
View file

@ -34,6 +34,36 @@ Note: Please add new entries to the beginning of this file.
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
<vuln vid="cf484358-b5d6-11dc-8de0-001c2514716c">
<topic>dovecot -- Specific LDAP + auth cache configuration may mix up user logins</topic>
<affects>
<package>
<name>dovecot</name>
<range><lt>1.0.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Dovecot reports:</p>
<blockquote cite="http://www.dovecot.org/list/dovecot-news/2007-December/000057.html">
<p>If two users with the same password and same pass_filter
variables log in within auth_cache_ttl seconds (1h by default),
the second user may get logged in with the first user's cached
pass_attrs. For example if pass_attrs contained the user's
home/mail directory, this would mean that the second user will
be accessing the first user's mails.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.dovecot.org/list/dovecot-news/2007-December/000057.html</url>
</references>
<dates>
<discovery>2007-12-21</discovery>
<entry>2007-12-29</entry>
</dates>
</vuln>
<vuln vid="4aab7bcd-b294-11dc-a6f0-00a0cce0781e">
<topic>gallery2 -- multiple vulnerabilities</topic>
<affects>