Description
Kolab Server 2.0.1, 2.0.2 and development versions pre-2.1-20051215 and earlier, when authenticating users via secure SMTP, stores authentication credentials in plaintext in the postfix.log file, which allows local users to gain privileges.
References
- 18438 third-party-advisory
- kolab-smtp-logging(24123) vdb-entry
- ADV-2006-0186 vdb-entry
- http://kolab.org/security/kolab-vendor-notice-08.txt
- 22381 vdb-entry