CVE-2001-1354 NetWin Authentication module (NWAuth) 2.0 and 3.0b, as implemented in SurgeFTP, DMail, and possibly other packages, uses weak password hashing, which could allow local users to decrypt passwords or us...
MediumCVSS 4.6
EPSS 0.78%
- Published
- Updated
- Exploit status
- No public exploit known
Description
NetWin Authentication module (NWAuth) 2.0 and 3.0b, as implemented in SurgeFTP, DMail, and possibly other packages, uses weak password hashing, which could allow local users to decrypt passwords or use a different password that has the same hash value as the correct password.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| netwin dmail | = 2.5d | No fix listed |
| netwin dmail | = 2.7 | No fix listed |
| netwin dmail | = 2.7q | No fix listed |
| netwin dmail | = 2.7r | No fix listed |
| netwin dmail | = 2.8e | No fix listed |
| netwin dmail | = 2.8f | No fix listed |
| netwin dmail | = 2.8g | No fix listed |
| netwin dmail | = 2.8h | No fix listed |
| netwin dmail | = 2.8i | No fix listed |
| netwin surgeftp | = 1.0b | No fix listed |
| netwin surgeftp | = 2.0a | No fix listed |
| netwin surgeftp | = 2.0b | No fix listed |
References
- 20010720 NetWin Authentication Module 3.0b password storage vulnerabilities / buffer overflows mailing-list vendor-advisory
- 3075 exploit vdb-entry vendor-advisory
- netwin-nwauth-weak-encryption(6866) vdb-entry