PT-2009-2453 · Pop3+3 · Pop3+3

Publicado 2009-08-18 · Atualizado 2017-08-17 · CVE-2008-6984

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Plesk version 8.6.0

Description The issue allows remote attackers to bypass authentication and send spam e-mail when short mail login names are enabled. This can be achieved by sending a message with a base64-encoded username that begins with a valid shortname, or a username that matches a valid password. The exploitation can occur through various protocols, including SMTP with qmail, and Courier IMAP and POP3.

Recommendations For Plesk version 8.6.0, consider disabling the use of short mail login names (SHORTNAMES) to prevent authentication bypass and spam e-mail sending until a patch is available. Additionally, restrict access to SMTP, qmail, Courier IMAP, and POP3 services to minimize the risk of exploitation.

Exploit

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2008-6984

Produtos afetados

Courier-Imap

Pop3

Plesk

Qmail

Referências · 6

• 🔥 http://securityfocus.com/archive/1/495881 · Exploit
• http://securitytracker.com/id?1020801 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44856 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-6984 · Nota de Segurança
• http://securityfocus.com/bid/30956 · Nota
• http://osvdb.org/51652 · Nota