vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2013-6171

N/A
Published: December 9, 2013 at 11:00 AM UTC
Updated: June 17, 2026 at 12:00 AM UTC
1 product affected across 1 vendorDovecot

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
N/A
Exploit prediction
EPSS 1%

Description

checkpassword-reply in Dovecot before 2.2.7 performs setuid operations to a user who is authenticating, which allows local users to bypass authentication and access virtual email accounts by attaching to the process and using a restricted file descriptor to modify account information in the response to the dovecot-auth server.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (5)

x_refsource_MISC
Source: [email protected]
http://cpanel.net/tsr-2013-0010-full-disclosure/
Third Party Advisoryx_refsource_SECUNIAVendor Advisory
Source: [email protected]
http://secunia.com/advisories/54808
x_refsource_CONFIRM
Source: [email protected]
http://wiki2.dovecot.org/AuthDatabase/CheckPassword#Security
Mailing Listx_refsource_MLISTPatch
Source: [email protected]
http://www.dovecot.org/list/dovecot-news/2013-November/000264.html
Vendor Advisoryx_refsource_UBUNTU
Source: [email protected]
https://usn.ubuntu.com/3556-2/

CVSS

5.8MEDIUM[email protected]
Confidentiality
PARTIAL
Integrity
PARTIAL
Availability
NONE
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-287

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card