CVE-1999-1445: Medium severity Slackware Slackware Linux vulnerability
Vulnerability in imapd and ipop3d in Slackware 3.4 and 3.3 with shadowing enabled, and possibly other operating systems, allows remote attackers to cause a core dump via a short sequence of USER and PASS commands that do not provide valid usernames or passwords.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Slackware imapd/ipop3dfrom your environment.If IMAP and POP3 services are not required, uninstall or stop imapd and ipop3d to eliminate exposure to the vulnerability.
- Configuration
Disable shadowing (shadow passwords) for imapd and ipop3d so the daemon does not operate with shadowing enabled, which is required for the vulnerability to be exploitable.
Slackware imapd/ipop3d shadowing = disabled - Compensating control
Restrict network access to IMAP and POP3 services (imapd and ipop3d) at the firewall or network ACLs to trusted hosts only to prevent remote attackers from reaching the vulnerable services.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1445?
CVE-1999-1445 is classified as a moderate to high severity vulnerability due to its potential to allow remote attackers to cause a denial of service.
How do I fix CVE-1999-1445?
To remediate CVE-1999-1445, it is advised to upgrade to a patched version of Slackware or to implement workarounds that restrict the use of the USER and PASS commands.
What systems are affected by CVE-1999-1445?
CVE-1999-1445 affects Slackware versions 3.3 and 3.4 with shadowing enabled, and possibly other similar operating systems.
Can CVE-1999-1445 be exploited remotely?
Yes, CVE-1999-1445 can be exploited remotely by sending a specific sequence of commands to the IMAP or POP3 services.
What are the potential impacts of CVE-1999-1445?
The potential impacts of CVE-1999-1445 include a core dump, which may lead to a denial of service, affecting system availability.