Description
The open source version of Open-Xchange 0.8.2 and earlier uses a static default username and password with a valid login shell in the initfile for the ldap-server, which allows remote attackers to access any server where the default has not been changed.
References
- http://www.open-xchange.org/bugzilla/show_bug.cgi?id=2815
- 18115 vdb-entry
- 20060526 Wavecon Advisory: Open-Xchange <= 0.8.2 defaultuser with /bin/bash and default password mailing-list
- ADV-2006-2037 vdb-entry
- 20323 third-party-advisory
- openxchange-ldap-default-account(26761) vdb-entry
- 1012 third-party-advisory
- http://www.golem.de/0605/45407.html