PT-2007-2564 · Putmail · Putmail

Publicado 2007-02-27 · Atualizado 2017-07-29 · CVE-2007-1137

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Putmail versions prior to 1.4

Description The issue arises when a user attempts to use TLS with a server that does not support it. In such cases, the software fails to detect the lack of TLS support and sends the username and password in plaintext, despite the user's belief that encryption is in use. This allows remote attackers to obtain sensitive information.

Recommendations For versions prior to 1.4, update to version 1.4 or later to resolve the issue. As a temporary workaround, consider disabling TLS usage with servers that do not support it to minimize the risk of exploitation. Restrict access to sensitive information until the issue is resolved by updating the software.

Correção

Identificadores relacionados

CVE-2007-1137

Produtos afetados

Putmail

Referências · 7

• http://securityfocus.com/bid/22718 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-1137 · Nota de Segurança
• http://putmail.sourceforge.net/home.html · Nota
• http://secunia.com/advisories/24266 · Aviso do Fabricante
• http://vupen.com/english/advisories/2007/0753 · Nota
• http://osvdb.org/33764 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32689 · Nota