PT-2001-2476 · Netwin · Surgeftp+2

Published 2001-07-20 · Updated 2017-12-19 · CVE-2001-1354

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions NetWin Authentication module (NWAuth) versions 2.0 through 3.0b SurgeFTP (affected versions not specified) DMail (affected versions not specified)

Description The issue is related to weak password hashing in the NetWin Authentication module. This could allow local users to decrypt passwords or use a different password that has the same hash value as the correct password.

Recommendations For NetWin Authentication module (NWAuth) versions 2.0 through 3.0b, consider updating the password hashing mechanism to a stronger algorithm. For SurgeFTP, update to a version that uses a secure password hashing mechanism, if available. For DMail, update to a version that uses a secure password hashing mechanism, if available. As a temporary workaround, consider restricting access to sensitive areas of the system to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2001-1354

Affected Products

Dmail

Netwin Authentication Module

Surgeftp

References · 5

• 🔥 http://securityfocus.com/bid/3075 · Exploit
• 🔥 https://exploit-db.com/exploits/21020 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2001-1354 · Security Note
• http://online.securityfocus.com/archive/1/198293 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/6866 · Note