Qpopper Username Information Disclosure Weakness

Bugtraq ID:	7110
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 15 2003 12:00AM
Updated:	Mar 15 2003 12:00AM
Credit:	Discovery of this vulnerability credited to Dennis Lubert <[email protected]>.
Vulnerable:	Qualcomm qpopper 4.0.5 fc2 Qualcomm qpopper 4.0.5 Qualcomm qpopper 4.0.4 Qualcomm qpopper 3.1 Qualcomm qpopper 3.0.2
Not Vulnerable:

Qpopper Username Information Disclosure Weakness

An information disclosure weakness has been reported for Qpopper when authenticating. The weakness is due to the fact that if a valid username is sent with a bad password, Qpopper will wait a small amount of time prior to disconnecting the client. If the username that is sent is invalid, Qpopper immediately disconnects the client.

A determined attacker can exploit this weakness to gather a list of valid usernames on a vulnerable system using Qpopper.

Qpopper Username Information Disclosure Weakness

The following exploit was provided:

• /data/vulnerabilities/exploits/poptest.cpp

Qpopper Username Information Disclosure Weakness

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Qpopper Username Information Disclosure Weakness

References:

• Qpopper Homepage (Qualcomm)
  
• ConnecTalk Security Advisory: Qpopper leaks information during authentication ("Marc Lafortune" )
  
• qpopper timing analysis on to determine if a username exists on a system (Dennis Lubert )
  
• Re: ConnecTalk Security Advisory: Qpopper leaks information during authentica (Justin Wheeler )