CVE-2001-0990: Medium severity Inter7 vpopmail vulnerability
Published Sep 4, 2001
·Updated
Inter7 vpopmail 4.10.35 and earlier, when using the MySQL module, compiles authentication information in cleartext into the libvpopmail.a library, which allows local users to obtain the MySQL username and password by inspecting the vpopmail programs that use the library.
Affected Software
18 affected components
Inter7 vpopmail=3.4.1
Inter7 vpopmail=3.4.2
Inter7 vpopmail=3.4.3
Inter7 vpopmail=3.4.4
Inter7 vpopmail=3.4.5
Inter7 vpopmail=3.4.6
Inter7 vpopmail=3.4.7
Inter7 vpopmail=3.4.8
Inter7 vpopmail=3.4.9
Inter7 vpopmail=3.4.10
Inter7 vpopmail=3.4.11
Inter7 vpopmail=3.4.11e
Inter7 vpopmail=4.5
Inter7 vpopmail=4.6
Inter7 vpopmail=4.7
Inter7 vpopmail=4.8
Inter7 vpopmail=4.9
Inter7 vpopmail=4.9.10
Remediation
Patch Available
Event History
Sep 4, 2001
CVE Published
04:00 AM
Feb 2, 2002
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2001-0990?
CVE-2001-0990 is classified as a moderate severity vulnerability.
2
How do I fix CVE-2001-0990?
To fix CVE-2001-0990, upgrade to vpopmail version 4.10.36 or later.
3
What type of information is exposed in CVE-2001-0990?
CVE-2001-0990 exposes MySQL usernames and passwords compiled in cleartext.
4
Which versions of Inter7 vpopmail are affected by CVE-2001-0990?
Versions 4.10.35 and earlier, as well as several 3.x versions of Inter7 vpopmail, are affected by CVE-2001-0990.
5
Can local users exploit CVE-2001-0990?
Yes, local users can exploit CVE-2001-0990 by inspecting the vpopmail programs using the libvpopmail.a library.