CVE-2013-6796

The SMTP server in DeepOfix 3.3 and earlier allows remote attackers to bypass authentication via an empty password, which triggers an LDAP anonymous bind.

Score

CVSS 2.0 5.0 Medium

Status

Modified - cve@mitre.org

Published

2014-10-26

Last modified

2024-08-06

Weaknesses

CWE-264

Affected products

• Deepofix (Deeproot Linux)

References

• http://packetstormsecurity.com/files/124054
• http://www.exploit-db.com/exploits/29706
• http://www.osvdb.org/100007
• http://www.securityfocus.com/bid/63793
• https://exchange.xforce.ibmcloud.com/vulnerabilities/89077