CERTA-2004-AVI-328
Vulnerability from certfr_avis

None

Description

SASL (Simple Authentication and Security Layer) est un mécanisme permettant d'ajouter des fonctionnalités d'authentification à des protocoles réseau.

L'installation du packetage sasl-bin, pour intégrer SASL dans le serveur de messagerie sendmail, emploie un compte possèdant un mot de passe par défaut. Cette vulnérabilité peut permettre à un utilisateur mal intentionné d'employer le serveur de messagerie comme relais ouvert afin d'envoyer des méls non sollicités.

Solution

Appliquer le correctif fourni par l'éditeur (cf. Documentation).

None
Impacted products
Vendor Product Description
Sendmail sendmail Les versions de sendmail antérieures à 8.12.3-.71 avec la distribution Debian stable (woody) ;
Sendmail sendmail les versions de sendmail antérieures à 8.13.1-.13 avec la distribution Debian unstable (sid).
References

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Les versions de sendmail ant\u00e9rieures \u00e0 8.12.3-.71 avec la distribution Debian stable (woody) ;",
      "product": {
        "name": "sendmail",
        "vendor": {
          "name": "Sendmail",
          "scada": false
        }
      }
    },
    {
      "description": "les versions de sendmail ant\u00e9rieures \u00e0 8.13.1-.13 avec la distribution Debian unstable (sid).",
      "product": {
        "name": "sendmail",
        "vendor": {
          "name": "Sendmail",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nSASL (Simple Authentication and Security Layer) est un m\u00e9canisme\npermettant d\u0027ajouter des fonctionnalit\u00e9s d\u0027authentification \u00e0 des\nprotocoles r\u00e9seau.\n\nL\u0027installation du packetage `sasl-bin`, pour int\u00e9grer SASL dans le\nserveur de messagerie sendmail, emploie un compte poss\u00e8dant un mot de\npasse par d\u00e9faut. Cette vuln\u00e9rabilit\u00e9 peut permettre \u00e0 un utilisateur\nmal intentionn\u00e9 d\u0027employer le serveur de messagerie comme relais ouvert\nafin d\u0027envoyer des m\u00e9ls non sollicit\u00e9s.\n\n## Solution\n\nAppliquer le correctif fourni par l\u0027\u00e9diteur (cf. Documentation).\n",
  "cves": [],
  "initial_release_date": "2004-09-29T00:00:00",
  "last_revision_date": "2004-09-29T00:00:00",
  "links": [],
  "reference": "CERTA-2004-AVI-328",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2004-09-29T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": null,
  "title": "Vuln\u00e9rabilit\u00e9 dans Sendmail avec SASL",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 DSA-554-1 de Debian",
      "url": "http://www.debian.org/security/2004/dsa-554"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.