 | ||||||
| << Previous | INDEX | Search | src | Set bookmark | Go to bookmark | Next >> |
| ||||||
| |||||||||||||||||||||
X-RDate: Tue, 03 Feb 1998 10:17:15 +0500 (ESK) Date: Mon, 2 Feb 1998 13:30:20 +0200 From: "raf@licj..... (Bugtraq Mirror)" <bugtraq@LICJ.SOROSCJ.RO> To: BUGTRAQ@NETSPACE.ORG Subject: Re: imapd/ipop3d coredump in slackware 3.4 On Mon, 2 Feb 1998, Peter van Dijk wrote: > [attic bug report nr. 1] > > While fooling around a little with NIS/YP (didn't get it completely > working...) I ran into a bug in the imapd and ipop3d that come with > slackware 3.4 (if you install the pine package). > Earlier slackware versions will problably NOT suffer from this bug, > because they did not include shadowing. > > When fed an unknown username, imapd and ipop3d will dump core: > > [root@koek] /# telnet zopie 110 > Trying 10.10.13.1... > Connected to zopie.attic.vuurwerk.nl. > Escape character is '^]'. > +OK zopie.attic.vuurwerk.nl POP3 3.3(20) w/IMAP2 client (Comments to MRC@CAC.Washington.EDU) at Sun, 1 Feb 1998 23:45:06 +0100 (CET) > user root > +OK User name accepted, password please > pass linux > [this is not the correct password] > -ERR Bad login > user john > [i have no user named john] > +OK User name accepted, password please > pass doe > Connection closed by foreign host. > This does not affect slackware 3.3 (which HAS shadow !!!!!). May be a bug in that version of ipop3d :( root@licj:~# tn licj 110 Trying 193.226.84.250... Connected to licj.soroscj.ro. Escape character is '^]'. +OK licj POP3 Server (Version 1.005h) ready at <Mon Feb 02 13:27:01 1998> user root +OK please send PASS command pass kaka -ERR invalid usercode or password, please try again user kkt +OK please send PASS command pass lksdghsql -ERR invalid usercode or password, please try again user raf +OK please send PASS command pass a;sdkljfh -ERR invalid usercode or password, please try again ........ and so on..... Radu-Adrian Feurdean
| |||||||||||||||||||||
|
|