IMail Server Password Encryption Algorithm Lets Local Decrypt Passwords
|
|
SecurityTracker Alert ID: 1023552 |
|
SecurityTracker URL: http://securitytracker.com/id?1023552
|
|
CVE Reference:
GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Feb 5 2010
|
Impact:
Disclosure of authentication information
|
Exploit Included: Yes
|
Version(s): 11.01
|
Description:
A vulnerability was reported in IMail Server. A local user can obtain passwords.
The IMail password decryption algorithm in 'IMailsec.dll' can be reversed. A local user can obtain passwords.
In addition, the registry configuration allows the Internet Guest account to have "Full Control" over the IMail directory.
The vendor was notified on January 21, 2010.
sinn3r from Corelan Security Team reported this vulnerability.
|
Impact:
A local user can obtain passwords.
|
Solution:
No solution was available at the time of this entry.
|
Vendor URL: www.ipswitch.com/ (Links to External Site)
|
Cause:
Access control error
|
Underlying OS:
Windows (2000), Windows (2003)
|
|
Message History:
None.
|
Source Message Contents
|
|
|
[Original Message Not Available for Viewing]
|
|
