Description
hfaxd in HylaFAX before 4.2.1, when installed with a "weak" hosts.hfaxd file, allows remote attackers to authenticate and bypass intended access restrictions via a crafted (1) username or (2) hostname that satisfies a regular expression that is matched against a hosts.hfaxd entry without a password.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | hylafax | 1:4.2.1-1 | — |
| Debian 13 | hylafax | 1:4.2.1-1 | — |
| Debian 12 | hylafax | 1:4.2.1-1 | — |
| Debian 3.0 | hylafax | 1:4.1.1-3.1 | DSA-634-1 |
Advisories 1
- DSA-634-1 hylafax - weak hostname and username validation Debian Security (DSA / DLA) · Mar 9, 2026
References
- GLSA-200501-21 vendor-advisory
- DSA-634 vendor-advisory
- MDKSA-2005:006 vendor-advisory
- 20050111 HylaFAX hfaxd unauthorized login vulnerability mailing-list
- [hylafax-announce] 20050111 **ANOUNCE** hylafax-4.2.1 released mailing-list
- 13812 third-party-advisory