PT-2001-2476 · Netwin · Surgeftp+2

Publicado 2001-07-20 · Atualizado 2017-12-19 · CVE-2001-1354

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Média

Vetor base

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions NetWin Authentication module (NWAuth) versions 2.0 through 3.0b SurgeFTP (affected versions not specified) DMail (affected versions not specified)

Description The issue is related to weak password hashing in the NetWin Authentication module. This could allow local users to decrypt passwords or use a different password that has the same hash value as the correct password.

Recommendations For NetWin Authentication module (NWAuth) versions 2.0 through 3.0b, consider updating the password hashing mechanism to a stronger algorithm. For SurgeFTP, update to a version that uses a secure password hashing mechanism, if available. For DMail, update to a version that uses a secure password hashing mechanism, if available. As a temporary workaround, consider restricting access to sensitive areas of the system to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2001-1354

Produtos afetados

Dmail

Netwin Authentication Module

Surgeftp

Referências · 5

• 🔥 http://securityfocus.com/bid/3075 · Exploit
• 🔥 https://exploit-db.com/exploits/21020 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/6866 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2001-1354 · Nota de Segurança
• http://online.securityfocus.com/archive/1/198293 · Aviso do Fabricante