Description
The register_user function in client/new_account_form.php in Domain Technologie Control (DTC) before 0.32.9 includes a cleartext password in an e-mail message, which makes it easier for remote attackers to obtain sensitive information by sniffing the network.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | dtc | 0.29.17-1+lenny1 | DSA-2179-1 |
Advisories 1
- DSA-2179-1 dtc - SQL injection Debian Security (DSA / DLA) · Mar 9, 2026
References
- 43523 third-party-advisory
- ADV-2011-0556 vdb-entry
- http://packages.debian.org/changelogs/pool/main/d/dtc/dtc_0.29.17-1+lenny1/changelog
- [oss-security] 20110222 CVE-2011-0436: dtc sends password of new users to site admin by unencrypted email mailing-list
- http://git.gplhost.com/gitweb/?p=dtc.git%3Ba=commit%3Bh=adffff7efb3687ff465ee0552a944dd3109f3cb0
- DSA-2179 vendor-advisory
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=614302
- http://git.gplhost.com/gitweb/?p=dtc.git%3Ba=commit%3Bh=f8e3b2d7cc2da313addc05394568ab9599499285
- dtc-passwords-info-disc(65898) vdb-entry
- http://packages.debian.org/changelogs/pool/main/d/dtc/dtc_0.32.10-1/changelog
- [dtcannounce] 20110303 Fwd: [SECURITY] [DSA 2179-1] dtc security update mailing-list