AMLServer Plaintext Password Vulnerability

Bugtraq ID:	2882
Class:	Design Error
CVE:	CVE-2001-0786
Remote:	No
Local:	Yes
Published:	Jun 18 2001 12:00AM
Updated:	Jul 11 2009 06:56AM
Credit:	This vulnerability was submitted to BugTraq on June 18th, 2001 by SNS Research <[email protected]>.
Vulnerable:	Internet Software Solutions Air Messenger LAN Server 3.4.2 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT 4.0
Not Vulnerable:

AMLServer Plaintext Password Vulnerability

Air Messenger LAN Server for Microsoft Windows allows users to exchange phone, pager and email messages through a Web gateway.

AMLServer stores its password file in plaintext. The effect is that attackers who've found a way to disclose the password file can access password protected AMLServer services.

NOTE: Two other vulnerabilities exist in AMLServer which enhance the exploitability of this vulnerability. These are BID 2883 and BID 2881.

AMLServer Plaintext Password Vulnerability

Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

AMLServer Plaintext Password Vulnerability

References:

• AMLServer vendor website (Internet Software Solutions)