PT-2005-1400 · Merak · Merak Mail Server

Shineshadow · Publicado 2005-02-10 · Atualizado 2017-07-11 · CVE-2005-0322

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MERAK Mail Server versions 7.6.0 through 7.6.4r

Description The issue concerns the use of weak encryption in certain configuration files, specifically users.cfg, settings.cfg, users.dat, or user.dat files. This weakness allows local users to extract passwords from these files.

Recommendations For MERAK Mail Server versions 7.6.0 through 7.6.4r, consider restricting access to the users.cfg, settings.cfg, users.dat, and user.dat files to minimize the risk of password extraction. Additionally, as a temporary workaround, limit local user privileges to reduce the potential for exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2005-0322

Produtos afetados

Merak Mail Server

Referências · 3

• http://marc.info/?l=bugtraq&m=110693950205007&w=2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-0322 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19153 · Nota