NetWin Authentication module (NWAuth) 2.0 and 3.0b, as implemented in SurgeFTP, DMail, and possibly other packages, uses weak password hashing, which could allow local users to decrypt passwords or use a different password that has the same hash value as the correct password.
Link | Tags |
---|---|
https://exchange.xforce.ibmcloud.com/vulnerabilities/6866 | vdb entry |
http://www.securityfocus.com/bid/3075 | exploit vdb entry vendor advisory |
http://online.securityfocus.com/archive/1/198293 | mailing list vendor advisory |