Description
avast! Server Edition before 4.7.726 does not demand a password in a certain intended context, even when a password has been set, which allows local users to bypass authentication requirements.
References
- http://www.avast.com/eng/avast-4-server-revision-history.html
- avast-password-security-bypass(32269) vdb-entry
- 24068 third-party-advisory
- ADV-2007-0499 vdb-entry
- 33114 vdb-entry
- 22425 vdb-entry