PT-2005-2509 · Dmail · Dmail

Published 2005-05-11 · Updated 2017-07-11 · CVE-2005-1516

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions DMail version 3.1a

Description The issue allows remote attackers to bypass authentication, read log files, and shutdown the system. This is achieved by sending a sendlog command with an incorrect password hash, which is not properly handled by the cmd sendlog function.

Recommendations For DMail version 3.1a, consider disabling the sendlog command or restricting access to the cmd sendlog function until a patch is available to properly handle incorrect password hashes and prevent unauthorized actions.

Fix

Related Identifiers

CVE-2005-1516

Affected Products

Dmail

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2005-1516 · Security Note
• http://secunia.com/advisories/15242 · Vendor Advisory
• http://securityfocus.com/bid/13497 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/20412 · Note
• http://security.org.sg/vuln/dmail31a.html · Note