849671 – (CVE-2013-6171) VUL-0: CVE-2013-6171: dovecot*: passdb checkpassword bypass

Bug 849671 (CVE-2013-6171) - VUL-0: CVE-2013-6171: dovecot*: passdb checkpassword bypass

Summary: VUL-0: CVE-2013-6171: dovecot*: passdb checkpassword bypass

Status:	RESOLVED WONTFIX

Alias:	CVE-2013-6171

Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents (show other bugs)
Version:	unspecified
Hardware:	Other openSUSE 13.2

Priority:	P3 - Medium Severity: Normal
Target Milestone:	---
Assignee:	Alexandre Rogoski
QA Contact:	Security Team bot

URL:
Whiteboard:
Keywords:

Depends on:
Blocks:

Clone This Bug

Reported:	2013-11-08 20:36 UTC by Marcus Meissner
Modified:	2015-06-15 16:26 UTC (History)
CC List:	3 users (show)

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Marcus Meissner 2013-11-08 20:36:40 UTC

CVE-2013-6171

http://wiki2.dovecot.org/AuthDatabase/CheckPassword#Security

* Some usage of passdb checkpassword could have been exploitable by
  local users. You may need to modify your setup to keep it working.
  See http://wiki2.dovecot.org/AuthDatabase/CheckPassword#Security


References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-6171
https://bugzilla.redhat.com/show_bug.cgi?id=1028589
http://wiki2.dovecot.org/AuthDatabase/CheckPassword#Security
http://www.dovecot.org/list/dovecot-news/2013-November/000264.html
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=729063

Comment 1 Swamp Workflow Management 2013-11-09 23:00:10 UTC

bugbot adjusting priority

Comment 2 Benjamin Brunner 2014-02-17 13:33:15 UTC

I'm not sure why this bug is assigned to maintenance@opensuse.org. Alexandre, if you have a fix, please open a maintenancerequest with your fixed package. (keep in mind to add the bugids, cveids and added/changed patches to your changelog-entry)
Thanks!

Reassigned to Alexandre.