[ GLSA 200501-21 ] HylaFAX: hfaxd unauthorized login vulnerability

[GLSA]

Gentoo Linux Security Advisory

Title: HylaFAX: hfaxd unauthorized login vulnerability (GLSA 200501-21)
Severity: normal
Exploitable: remote
Date: January 11, 2005
Bug(s): #75941
ID: 200501-21

Synopsis

HylaFAX is subject to a vulnerability in its username matching code, potentially allowing remote users to bypass access control lists.

Background

HylaFAX is a software package for sending and receiving facsimile messages.

Affected Packages

Package: net-misc/hylafax
Vulnerable: < 4.2.0-r2
Unaffected: >= 4.2.0-r2
Architectures: All supported architectures


Description

The code used by hfaxd to match a given username and hostname with an entry in the hosts.hfaxd file is insufficiently protected against malicious entries.

Impact

If the HylaFAX installation uses a weak hosts.hfaxd file, a remote attacker could authenticate using a malicious username or hostname and bypass the intended access restrictions.

Workaround

As a workaround, administrators may consider adding passwords to all entries in the hosts.hfaxd file.

Resolution

All HylaFAX users should upgrade to the latest version: