Description
authpam.c in courier-authdaemon for Courier Mail Server 0.37.3 through 0.52.1, when using pam_tally, does not call the pam_acct_mgmt function to verify that access should be granted, which allows attackers to authenticate to the server using accounts that have been disabled.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗Advisories 1
- DSA-917-1 courier - programming error Debian Security (DSA / DLA) · Mar 9, 2026
References
- DSA-917 vendor-advisory
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=211920
- 17919 third-party-advisory
- courier-authdaemon-unauth-access(23532) vdb-entry
- 15771 vdb-entry
- 17999 third-party-advisory
- USN-226-1 vendor-advisory