From: Secunia Security Advisories (sec-advsecunia.com)
Date: Wed Mar 03 2004 - 09:34:06 CST

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

TITLE:
eXtremail User Authentication Bypass Vulnerability

SECUNIA ADVISORY ID:
SA10993

VERIFY ADVISORY:
http://secunia.com/advisories/10993/

CRITICAL:
Moderately critical

IMPACT:
Security Bypass

WHERE:
From remote

SOFTWARE:
eXtremail 1.x

DESCRIPTION:
Andrey Smirnov has reported a vulnerability in eXtremail, allowing
malicious people to bypass user authentication.

eXtremail reportedly fails to properly verify authentication requests
to accounts with passwords starting with a digit. This can be
exploited to gain access to such an account using an arbitrary
password.

The vulnerability has been reported in version 1.5.9.

SOLUTION:
Ensure that passwords don't use digits as the first character.

PROVIDED AND/OR DISCOVERED BY:
Andrey Smirnov

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/

Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories

----------------------------------------------------------------------

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]