PT-2005-1400 · Merak · Merak Mail Server

Shineshadow · Published 2005-02-10 · Updated 2017-07-11 · CVE-2005-0322

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MERAK Mail Server versions 7.6.0 through 7.6.4r

Description The issue concerns the use of weak encryption in certain configuration files, specifically users.cfg, settings.cfg, users.dat, or user.dat files. This weakness allows local users to extract passwords from these files.

Recommendations For MERAK Mail Server versions 7.6.0 through 7.6.4r, consider restricting access to the users.cfg, settings.cfg, users.dat, and user.dat files to minimize the risk of password extraction. Additionally, as a temporary workaround, limit local user privileges to reduce the potential for exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2005-0322

Affected Products

Merak Mail Server

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2005-0322 · Security Note
• http://marc.info/?l=bugtraq&m=110693950205007&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19153 · Note