Description
qpopper 4.01 with PAM based authentication on Red Hat systems generates different error messages when an invalid username is provided instead of a valid name, which allows remote attackers to determine valid usernames on the system.
References
- 3242 vdb-entry
- qpopper-pam-auth-error(7047) vdb-entry
- 20010825 qpopper and pam.d mailing-list