DBMail Authentication Bypass Vulnerability

Bugtraq ID:	28849
Class:	Access Validation Error
CVE:	CVE-2007-6714
Remote:	Yes
Local:	No
Published:	Feb 09 2008 12:00AM
Updated:	Apr 13 2015 09:59PM
Credit:	vugluskr
Vulnerable:	Redhat Fedora 7 Gentoo Linux dbmail dbmail 2.2.8 dbmail dbmail 2.2.7 dbmail dbmail 2.2.6 dbmail dbmail 2.2.5
Not Vulnerable:	dbmail dbmail 2.2.9

DBMail Authentication Bypass Vulnerability

DBMail is prone to a vulnerability that may let attackers authenticate without a valid password in some configurations. This could let an attacker gain unauthorized access to emails stored by the application.

DBMail Authentication Bypass Vulnerability

The attacker may exploit the vulnerability by trying to authenticate with a blank password.

DBMail Authentication Bypass Vulnerability

Solution:
The vendor has released DBMail 2.2.9 to address the vulnerability. Other vendors have also released fixes. Please see the references for more information.


dbmail dbmail 2.2.5

• dbmail dbmail-2.2.9.tar.gz
  http://www.dbmail.org/download/2.2/dbmail-2.2.9.tar.gz

dbmail dbmail 2.2.6

• dbmail dbmail-2.2.9.tar.gz
  http://www.dbmail.org/download/2.2/dbmail-2.2.9.tar.gz

dbmail dbmail 2.2.7

• dbmail dbmail-2.2.9.tar.gz
  http://www.dbmail.org/download/2.2/dbmail-2.2.9.tar.gz

dbmail dbmail 2.2.8

• dbmail dbmail-2.2.9.tar.gz
  http://www.dbmail.org/download/2.2/dbmail-2.2.9.tar.gz

DBMail Authentication Bypass Vulnerability

References:

• DBMail 2.2.9 released (DBMail)
  
• DBMail Homepage (DBMail)