PT-2001-2213 · Red Hat · Qpopper

Published 2001-08-31 · Updated 2017-12-19 · CVE-2001-1068

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions qpopper version 4.01

Description The issue allows remote attackers to determine valid usernames on the system by generating different error messages when an invalid username is provided instead of a valid name. This occurs on Red Hat systems with qpopper 4.01 that uses PAM based authentication.

Recommendations For qpopper version 4.01, consider modifying the authentication mechanism to provide uniform error messages for both valid and invalid usernames to prevent attackers from determining valid usernames.

Exploit

Fix

Related Identifiers

CVE-2001-1068

Affected Products

Qpopper

References · 4

• 🔥 http://archives.neohapsis.com/archives/bugtraq/2001-08/0363.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2001-1068 · Security Note
• http://securityfocus.com/bid/3242 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/7047 · Note