Description
vpopmail 5.4.14 and 5.4.15, with cleartext passwords enabled, allows remote attackers to authenticate to an account that does not have a cleartext password set by using a blank password to (1) SMTP AUTH or (2) APOP.
References
- ADV-2006-1698 vdb-entry
- vpopmail-auth-bypass(26333) vdb-entry
- 19987 third-party-advisory
- 17894 vdb-entry
- 25445 vdb-entry
- http://sourceforge.net/project/shownotes.php?release_id=415350