Bug 132674 - net-mail/vpopmail: Cleartext Password Authentication Bypass
|
Bug#:
132674
|
Product: Gentoo Security
|
Version: unspecified
|
Platform: All
|
|
OS/Version: Linux
|
Status: RESOLVED
|
Severity: minor
|
Priority: P2
|
|
Resolution: FIXED
|
Assigned To: security@gentoo.org
|
Reported By: falco@gentoo.org
|
|
Component: Vulnerabilities
|
|
|
URL:
http://secunia.com/advisories/19987/
|
|
Summary: net-mail/vpopmail: Cleartext Password Authentication Bypass
|
|
Keywords:
|
|
Status Whiteboard: C3 [noglsa]
|
|
Opened: 2006-05-08 06:02 0000
|
original advisory :
http://sourceforge.net/project/shownotes.php?release_id=415350
SA19987 :
Description:
A security issue has been reported in vpopmail, which can be exploited by
malicious people to bypass certain security restrictions.
The security issue is caused due to an error within the handling of SMTP AUTH
and APOP password authentication. This can be exploited to authenticate to the
mail server using a blank password.
Successful exploitation requires that cleartext password authentication is
enabled and that the account does not have a cleartext password set.
The security issue has been reported in versions 5.4.14 and 5.4.15. Prior
versions may also be affected.
Solution:
The security issue has been fixed in development version 5.4.16.
5.4.16 is available correcting the issue, please provide a new ebuild :)
Commited to tree, Go ahead and mark stable.
ready for glsa-vote. tend to say no.
