From: Jaroslaw Zachwieja [mailto:grok () tnt pl]
Sent: Wednesday, March 12, 2003 8:20 AM
To: bugtraq () securityfocus com
Subject: Re: QPopper 4.0.x buffer overflow vulnerability
-----BEGIN PGP SIGNED MESSAGE-----
On pon 10. marca 2003 14:31, Florian Heinz wrote:
Feedback is welcome.
Enforcing TLS/SSL is a temprorary workaround against script-kiddies -
exploit (out-of-the-box) will not be able to authenticate.
(there is a user foobar, with passwd "lalala" on the system)
$ ./qex rootbox foobar lalala
Phase 1: Seeking buffer size
Connecting to xxx.xxx.xxx.xxx... Logging in... Could not log in. Did you
provide a valid username/password-combination?
Exiting due to error...
$ telnet 0 110
Connected to 0.
Escape character is '^]'.
- -ERR [AUTH] You must use TLS/SSL or stronger authentication such as APOP
connect to this server
Not a fix, but who sends plaintext passwords anyway :) Unfortunately, I
must assume, that at some point some "friendly" soul will equip qex with
What is the vendor response on that?
GPG public key at http://www.keyserver.net
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
-----END PGP SIGNATURE-----