BugTraq
sqwebmail web login Jan 31 2004 09:54AM
Marco Marabelli (mm smrt it) (2 replies)

platform:
linux 2.4 i386
pachages: qmail+sqwebmail+qmailadmin+vpopmail-vchkpw-auth.

When user root try loggin in on the web on http://domain/cgi-bin/sqwebmail,
if does it with right root password, sqwebmail gives an error "maildir
doesn't exist or has incorrect ownership or permission". This, ONLY if you
give right root password, if not, you have error "invalid user or password"
(as any other wrong password, for any user).
I think this should be a good method for guessing root password, in fact
failure logging in on the sqewebmail are not logged (generally!).

Regards,
Marco Marabelli

[ reply ]
Re: sqwebmail web login Feb 03 2004 08:55AM
Antonio Messina (messina retiesistemi it) (1 replies)
Re: sqwebmail web login Feb 04 2004 10:57PM
Tim Nelson (sysadmin sunet com au)
Re: sqwebmail web login Feb 03 2004 04:53AM
Brian Bothwell (sysrage sysrage net)


 

Privacy Statement
Copyright 2010, SecurityFocus