PT-2000-1871 · Netscape · Netscape Messaging Server

Publicado 2000-12-19 · Atualizado 2017-10-10 · CVE-2000-0960

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Netscape Messaging Server version 4.15p1

Description The issue allows remote attackers to determine valid users on the system and harvest email addresses for spam abuse by exploiting different error messages generated by the POP3 server for incorrect user names versus incorrect passwords.

Recommendations For Netscape Messaging Server version 4.15p1, consider modifying the POP3 server to return generic error messages for both incorrect user names and passwords to prevent user enumeration. As a temporary workaround, restrict access to the POP3 server to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2000-0960

Produtos afetados

Netscape Messaging Server

Referências · 4

• 🔥 http://securityfocus.com/bid/1787 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2000-0960 · Nota de Segurança
• http://marc.info/?l=bugtraq&m=97138100426121&w=2 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/5364 · Nota