NetSight
IP …
medium4.6Public exploit code

CVE-2001-1354

NetWin Authentication module (NWAuth) 2.0 and 3.0b, as implemented in SurgeFTP, DMail, and possibly other packages, uses weak password hashing, which could all…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

NetWin Authentication module (NWAuth) 2.0 and 3.0b, as implemented in SurgeFTP, DMail, and possibly other packages, uses weak password hashing, which could allow local users to decrypt passwords or use a different password that has the same hash value as the correct password.

Affected products

VendorProductAffected versions
NetwinDmail
Versions 2.5d, 2.7, 2.7q, 2.7r, 2.8e, 2.8f
NetwinSurgeftp
Versions 1.0b, 2.0a, 2.0b

References