PT-2001-2477 · Netwin · Netwin Authentication Module+2

Publicado 2001-07-20 · Atualizado 2017-12-19 · CVE-2001-1355

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions NetWin Authentication Module (NWAuth) version 3.0b and earlier

Description The issue is related to buffer overflows that could allow attackers to execute arbitrary code. This can be achieved by providing long arguments to specific commands, including the -del command or the -lookup command. The buffer overflows are present in the NetWin Authentication Module (NWAuth) as implemented in various packages such as DMail and SurgeFTP.

Recommendations For NetWin Authentication Module (NWAuth) version 3.0b and earlier, consider disabling the -del and -lookup commands until a patch is available to prevent potential exploitation. Restrict access to these commands to minimize the risk of arbitrary code execution.

Correção

Identificadores relacionados

CVE-2001-1355

Produtos afetados

Dmail

Netwin Authentication Module

Surgeftp

Referências · 4

• https://exchange.xforce.ibmcloud.com/vulnerabilities/6865 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2001-1355 · Nota de Segurança
• http://securityfocus.com/bid/3077 · Aviso do Fabricante
• http://online.securityfocus.com/archive/1/198293 · Aviso do Fabricante