PT-2000-1871 · Netscape · Netscape Messaging Server

Published 2000-12-19 · Updated 2017-10-10 · CVE-2000-0960

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Netscape Messaging Server version 4.15p1

Description The issue allows remote attackers to determine valid users on the system and harvest email addresses for spam abuse by exploiting different error messages generated by the POP3 server for incorrect user names versus incorrect passwords.

Recommendations For Netscape Messaging Server version 4.15p1, consider modifying the POP3 server to return generic error messages for both incorrect user names and passwords to prevent user enumeration. As a temporary workaround, restrict access to the POP3 server to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2000-0960

Affected Products

Netscape Messaging Server

References · 4

• 🔥 http://securityfocus.com/bid/1787 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2000-0960 · Security Note
• http://marc.info/?l=bugtraq&m=97138100426121&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/5364 · Note