Vulnerability in Netwin Dmail
CVE-2001-1354
NetWin Authentication module (NWAuth) 2.0 and 3.0b, as implemented in SurgeFTP, DMail, and possibly other packages, uses weak password hashing, which could allow local users to decrypt passwords or use a different password that has the same hash value as the correct password.
EPSS: 0.008 (52.1th percentile) — read the EPSS interpretation.
Affected products
- Netwin Dmail — versions 2.5d, 2.7, 2.7q
- Netwin Surgeftp — versions 1.0b, 2.0a, 2.0b
- N/a — versions n/a
References
- cve@mitre.org (vdb-entry, x_refsource_XF)
- cve@mitre.org (Exploit, vdb-entry, x_refsource_BID, Vendor Advisory)
- cve@mitre.org (Vendor Advisory, mailing-list, x_refsource_BUGTRAQ)