PT-2002-1305 · Castelle · Castelle Faxpress

Published 2002-05-03 · Updated 2008-09-05 · CVE-2002-0235

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Castelle FaxPress versions 6.3 and possibly other versions

Description The issue allows attackers to obtain the username and password by submitting an incorrect login. When configured to use the Network print queue, FaxPress leaks the correct username and password in plaintext in an error event.

Recommendations For version 6.3 and possibly other versions, consider restricting access to the Network print queue until a fix is available. As a temporary workaround, avoid using the Network print queue to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2002-0235

Affected Products

Castelle Faxpress

References · 4

• http://iss.net/security_center/static/8086.php · Vendor Advisory
• http://online.securityfocus.com/archive/1/254168 · Vendor Advisory
• http://securityfocus.com/bid/4030 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-0235 · Security Note