PT-1999-1686 · Pegasus · Pegasus

Publicado 1999-05-15 · Atualizado 2016-10-18 · CVE-1999-1366

Positive Technologies (AI Summary)

CVSS v2.0

3.6

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Pegasus e-mail client versions 3.0 and earlier

Description: The issue concerns the use of weak encryption to store POP3 passwords in the pmail.ini file. This weakness allows local users to easily decrypt the passwords, potentially enabling them to read e-mail.

Recommendations: For versions 3.0 and earlier, consider updating the encryption method used to store POP3 passwords to a stronger alternative. As a temporary workaround, restrict access to the pmail.ini file to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-1999-1366

Produtos afetados

Pegasus

Referências · 2

• http://marc.info/?l=bugtraq&m=92714118829880&w=2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-1999-1366 · Nota de Segurança