A vulnerability in DBMail's authldap module when used in conjunction
with an Active Directory server has been reported by vugluskr. When
passing a zero length password to the module, it tries to bind
anonymously to the LDAP server. If the LDAP server allows anonymous
binds, this bind succeeds and results in a successful authentication to
DBMail.
By passing an empty password string to the server, an attacker could be
able to log in to any account.
