PT-2005-4329 · Hylafax · Hylafax

Patrice Fournier · Published 2005-12-31 · Updated 2018-10-19 · CVE-2005-3538

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions HylaFAX version 4.2.3

Description The issue allows remote attackers to gain privileges by accepting arbitrary passwords when PAM support is disabled in hfaxd.

Recommendations For HylaFAX version 4.2.3, consider enabling PAM support to prevent the acceptance of arbitrary passwords. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2005-3538

Affected Products

Hylafax

References · 15

• https://osv.dev/vulnerability/CVE-2005-3538 · Vendor Advisory
• http://secunia.com/advisories/18337 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-3538 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2005-3538 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2005-3538 · Vendor Advisory
• http://bugs.hylafax.org/bugzilla/show_bug.cgi?id=719 · Patch
• http://secunia.com/advisories/18314 · Vendor Advisory
• http://securityfocus.com/bid/16150 · Patch
• http://mandriva.com/security/advisories?name=MDKSA-2006:015 · Vendor Advisory
• http://secunia.com/advisories/18489 · Note
• http://securityfocus.com/archive/1/420974/100/0/threaded · Note
• http://gentoo.org/security/en/glsa/glsa-200601-03.xml · Patch, Vendor Advisory
• http://hylafax.org/archive/2005-12/msg00119.php · Note
• http://hylafax.org/content/HylaFAX_4.2.4_release · Note
• http://vupen.com/english/advisories/2006/0072 · Note