Inter7 vpopmail MySQL Authentication Data Recovery Vulnerability
BID:3284
Info
Inter7 vpopmail MySQL Authentication Data Recovery Vulnerability
| Bugtraq ID: | 3284 |
| Class: | Design Error |
| CVE: |
CVE-2001-0990 |
| Remote: | No |
| Local: | Yes |
| Published: | Sep 04 2001 12:00AM |
| Updated: | Jul 11 2009 07:56AM |
| Credit: | Reported to Bugtraq by Gabriel Ambuehl <[email protected]> on September 4, 2001. |
| Vulnerable: |
Inter7 vpopmail (vchkpw) 4.9.10 Inter7 vpopmail (vchkpw) 4.9 Inter7 vpopmail (vchkpw) 4.8 Inter7 vpopmail (vchkpw) 4.7 Inter7 vpopmail (vchkpw) 4.6 Inter7 vpopmail (vchkpw) 4.5 Inter7 vpopmail (vchkpw) 3.4.11 e Inter7 vpopmail (vchkpw) 3.4.11 Inter7 vpopmail (vchkpw) 3.4.10 Inter7 vpopmail (vchkpw) 3.4.9 Inter7 vpopmail (vchkpw) 3.4.8 Inter7 vpopmail (vchkpw) 3.4.7 Inter7 vpopmail (vchkpw) 3.4.6 Inter7 vpopmail (vchkpw) 3.4.5 Inter7 vpopmail (vchkpw) 3.4.4 Inter7 vpopmail (vchkpw) 3.4.3 Inter7 vpopmail (vchkpw) 3.4.2 Inter7 vpopmail (vchkpw) 3.4.1 |
| Not Vulnerable: | |
Discussion
Inter7 vpopmail MySQL Authentication Data Recovery Vulnerability
Inter7 vpopmail is a freely-available software package that provides an way for system administrators to manage virtual email domains and non-system password based email accounts on Qmail or Postfix mail servers.
A vunerability exists in vpopmail that may result in the disclosure of sensitive authentication information when the package is configured to use a MySQL database. The command-line programs included in the package are linked against object files containing this authentication information, stored in cleartext.
The programs are installed with world-readable file access permissions. As a result, it may be possible for an attacker with local access to retrieve the authentication information by examining one of the programs.
Inter7 vpopmail is a freely-available software package that provides an way for system administrators to manage virtual email domains and non-system password based email accounts on Qmail or Postfix mail servers.
A vunerability exists in vpopmail that may result in the disclosure of sensitive authentication information when the package is configured to use a MySQL database. The command-line programs included in the package are linked against object files containing this authentication information, stored in cleartext.
The programs are installed with world-readable file access permissions. As a result, it may be possible for an attacker with local access to retrieve the authentication information by examining one of the programs.
Exploit / POC
Inter7 vpopmail MySQL Authentication Data Recovery Vulnerability
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
Inter7 vpopmail MySQL Authentication Data Recovery Vulnerability
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.