CVE-2001-1354

NetWin Authentication module (NWAuth) 2.0 and 3.0b, as implemented in SurgeFTP, DMail, and possibly other packages, uses weak password hashing, which could allow local users to decrypt passwords or use a different password that has the same hash value as the correct password.

Score

CVSS 2.0 4.6 Medium

Status

Modified - cve@mitre.org

Published

2001-07-20

Last modified

2024-08-08

Affected products

• Dmail (Netwin)
• Surgeftp (Netwin)

References

• http://online.securityfocus.com/archive/1/198293
• http://www.securityfocus.com/bid/3075
• https://exchange.xforce.ibmcloud.com/vulnerabilities/6866