[409] in linux-security and linux-alert archive
Re: POP3 security hole (Maybe just one distribution/binary?)
daemon@ATHENA.MIT.EDU (Marc Lewis)
Fri Oct 6 15:41:48 1995
Date: Wed, 4 Oct 1995 20:02:24 -0700 (PDT)
From: Marc Lewis <marc@blarg.net>
To: Panzer Boy <panzer@dhp.com>
cc: linux-security@tarsier.cv.nrao.edu
In-Reply-To: <199510041528.LAA20720@dhp.com>
On Wed, 4 Oct 1995, Panzer Boy wrote:
> Panzer Boy <panzer@dhp.com> writes to the Seattle Linux Mailing List:
>
> Has anyone poked into this yet? I just gleamed it off of of the Linux ISP
> list. I am running pop from the pine imap code (w/ shadow changes) and
> wasn't able to verify this problem, though I don't usually run bins I
> gleam from sunsite, et al.
>
> pine3.91 imap/pop shadow patches can be grabbed from:
> ftp.dhp.com:/pub/linux/security/pine.shadow
>
I just tested this on our system (v1.004) and it kept me out. I even tried
a few good passwords and it wouldn't let me in. We did build this
in.pop3d ourselves, however...
- Marc
-----------------------------+---------------------------------------------
Marc Lewis (marc@blarg.net) | Blarg! Online Services - Seattle, WA
Data: 206/812-1621 - or - | BBS - Shell - SLIP - PPP - 56k Frame Relay
telnet to animal.blarg.net | Consulting services & setup available
then login as 'new' | World-Wide-Web: http://www.blarg.net/
-----------------------------+---------------------------------------------
