SqWebMail Authentication Response Information Leakage Weakness

Bugtraq ID:	9541
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 31 2004 12:00AM
Updated:	Jan 31 2004 12:00AM
Credit:	Discovery of this issue is credited to "Marco Marabelli" <[email protected]>.
Vulnerable:	Inter7 SqWebMail 3.6.1 Inter7 SqWebMail 3.6 .0 Inter7 SqWebMail 3.5.3 Inter7 SqWebMail 3.5.2 Inter7 SqWebMail 3.5.1 Inter7 SqWebMail 3.5 .0 Inter7 SqWebMail 3.4.1
Not Vulnerable:

SqWebMail Authentication Response Information Leakage Weakness

SqWebMail leaks sensitive information in authentication responses that may permit aid an attacker in brute forcing the root password on the underlying operating system. The software reportedly issues different responses when the user authenticates successfully as the root user then when a failed attempt occurs. This may provide a covert means of brute-forcing the root password (or possibly other passwords) via the SqWebMail interface.

SqWebMail Authentication Response Information Leakage Weakness

There is no exploit required.

SqWebMail Authentication Response Information Leakage Weakness

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

SqWebMail Authentication Response Information Leakage Weakness

References:

• SqWebMail Homepage (Inter7)
  
• Re: sqwebmail web login (Tim Nelson )
  
• sqwebmail web login ("Marco Marabelli" )