FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2004-1182

This CVE name corresponds to:

Entered	Topic
2005-01-11	hylafax -- unauthorized login vulnerability

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2004-1182 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2004-1182
Phase	Assigned(20041213)

Description

hfaxd in HylaFAX before 4.2.1, when installed with a "weak" hosts.hfaxd file, allows remote attackers to authenticate and bypass intended access restrictions via a crafted (1) username or (2) hostname that satisfies a regular expression that is matched against a hosts.hfaxd entry without a password.

References

Source	Reference
BUGTRAQ	20050111 HylaFAX hfaxd unauthorized login vulnerability
MLIST	[hylafax-announce] 20050111 ANOUNCE hylafax-4.2.1 released
DEBIAN	DSA-634
GENTOO	GLSA-200501-21
MANDRAKE	MDKSA-2005:006
SECUNIA	13812