PT-2007-2564 · Putmail · Putmail

Published 2007-02-27 · Updated 2017-07-29 · CVE-2007-1137

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Putmail versions prior to 1.4

Description The issue arises when a user attempts to use TLS with a server that does not support it. In such cases, the software fails to detect the lack of TLS support and sends the username and password in plaintext, despite the user's belief that encryption is in use. This allows remote attackers to obtain sensitive information.

Recommendations For versions prior to 1.4, update to version 1.4 or later to resolve the issue. As a temporary workaround, consider disabling TLS usage with servers that do not support it to minimize the risk of exploitation. Restrict access to sensitive information until the issue is resolved by updating the software.

Fix

Related Identifiers

CVE-2007-1137

Affected Products

Putmail

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2007-1137 · Security Note
• http://secunia.com/advisories/24266 · Vendor Advisory
• http://securityfocus.com/bid/22718 · Note
• http://putmail.sourceforge.net/home.html · Note
• http://vupen.com/english/advisories/2007/0753 · Note
• http://osvdb.org/33764 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32689 · Note