CVE-2021-28374: 
Linux Debian vulnerability analysis and mitigation

The Debian courier-authlib package before version 0.71.1-2 for Courier Authentication Library created a /run/courier/authdaemon directory with weak permissions. The vulnerability was discovered in March 2021 and was assigned CVE-2021-28374. The issue affected multiple versions of courier-authlib including 0.71.1-1, 0.71.0-1, 0.69.0-2, and 0.66.4-9 (Debian Bug).

The vulnerability stems from incorrect permission assignments for a critical resource, specifically the /run/courier/authdaemon directory. The weak permissions allowed unauthorized access to the authentication daemon's socket directory. The issue has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (NVD).

The vulnerability allowed attackers to read sensitive user information through the exposed directory. The accessible information included user existence confirmation, UIDs, GIDs, home directory paths, Maildir locations, quota information, and password-related data such as hashes. In some configurations, cleartext passwords could also be exposed (Debian LTS).

The vulnerability could be exploited by any user with access to the system, as the directory permissions were too permissive. The authtest utility could be used to query user database information, potentially enabling brute force attacks when combined with the authpasswd tool (Debian Bug).

The issue was fixed in courier-authlib version 0.71.1-2 by tightening permissions on the /run/courier/authdaemon directory. For Debian 9 (stretch), the fix was backported to version 0.66.4-9+deb9u1. A temporary workaround before patching involved manually restricting access to the authtest program by setting permissions to 750 and ownership to courier:root (Debian LTS).