PT-1999-1686 · Pegasus · Pegasus

Published 1999-05-15 · Updated 2016-10-18 · CVE-1999-1366

Positive Technologies (AI Summary)

CVSS v2.0

3.6

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Pegasus e-mail client versions 3.0 and earlier

Description: The issue concerns the use of weak encryption to store POP3 passwords in the pmail.ini file. This weakness allows local users to easily decrypt the passwords, potentially enabling them to read e-mail.

Recommendations: For versions 3.0 and earlier, consider updating the encryption method used to store POP3 passwords to a stronger alternative. As a temporary workaround, restrict access to the pmail.ini file to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-1999-1366

Affected Products

Pegasus

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-1999-1366 · Security Note
• http://marc.info/?l=bugtraq&m=92714118829880&w=2 · Note