Executive brief
A vulnerability in the email services of Slackware Linux 3.3 and 3.4 can cause the system to crash when receiving specific login sequences. This crash may result in the creation of a 'core dump' file that contains sensitive system information, including encrypted passwords from the server. An attacker could potentially use this information to gain unauthorized access to the system.
Technical details
The vulnerability exists in the imapd and ipop3d daemons included with Slackware 3.3 and 3.4 when shadow password support is enabled. The issue stems from a patch in 'log_lnx.c' that removed a null pointer check for the password structure. A remote attacker can trigger a segmentation fault (SIGSEGV) by providing a specific sequence of invalid USER and PASS commands (e.g., attempting to log in as a non-existent user after a failed login attempt). This results in a core dump which, depending on local file permissions, may contain sensitive data from /etc/shadow, potentially allowing an attacker to retrieve password hashes if they have local access to the resulting core file.
Affected products
- Slackware Slackware Linux 3.3, 3.4
Timeline
- 1998-02-02: disclosed: Initial bug report on Bugtraq mailing list
- 1998-02-02: advisory: NVD publication date