vpopmail SMTP AUTH and APOP authentication bypass
| vpopmail-auth-bypass (26333) |  Medium Risk |
Description:
vpopmail could allow a remote attacker to bypass authentication. If cleartext passwords are enabled, a remote attacker could authenticate with SMTP AUTH and APOP methods using a blank password, if the targeted account does not have a cleartext password set.
Consequences:
Bypass Security
Remedy:
Upgrade to the latest version of vpopmail (5.4.16 or later), available from SourceForge.net. See References.
References:
- SourceForge.net: Files: vpopmail - virtual domains for qmail - File Release Notes and Changelog - Release Name: 5.4.16.
- BID-17894: Inter7 Vpopmail Authentication Bypass Vulnerability
- CVE-2006-2346: vpopmail 5.4.14 and 5.4.15, with cleartext passwords enabled, allows remote attackers to authenticate to an account that does not have a cleartext password set by using a blank password to (1) SMTP AUTH or (2) APOP.
- OSVDB ID: 25445: vpopmail Cleartext Password Authentication Bypass
- SA19987: vpopmail Cleartext Password Authentication Bypass
- VUPEN/ADV-2006-1698: vpopmail SMTP AUTH and APOP Password Authentication Bypass Vulnerability
Platforms Affected:
- Inter7 vpopmail prior to 5.4.16
Reported:
May 07, 2006
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net