OSVDB ID: 25445 Title: vpopmail Cleartext Password Authentication Bypass |
Info |
|
|
Dates |
||||
|
|
Description |
vpopmail contains a flaw that may allow a malicious user to bypass certain security restrictions. The issue is triggered due to an error within the handling of SMTP AUTH and APOP password authentication. It is possible that the flaw may allow an attacker to authenticate to the mail server using a blank password resulting in a loss of confidentiality. |
Classification |
Location:
Remote / Network Access
Attack Type: Cryptographic, Information Disclosure, Input Manipulation Impact: Loss of Confidentiality Exploit: Exploit Public Disclosure: OSVDB Verified, Vendor Verified |
Solution |
Upgrade to version 5.4.16 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds. |
Products |
|
References |
|
Credit |
Unknown or Incomplete |