GLSA 200502-02: UW IMAP: CRAM-MD5 authentication bypass

http://security.gentoo.org/

Severity:	normal
Title:	UW IMAP: CRAM-MD5 authentication bypass
Date:	02/02/2005
Bugs:	#79874
ID:	200502-02

Synopsis

UW IMAP contains a vulnerability in the code handling CRAM-MD5 authentication allowing authentication bypass.

Background

UW IMAP is the University of Washington IMAP toolkit which includes POP3 and IMAP daemons.

Affected packages

Package	Vulnerable	Unaffected	Architecture(s)
net-mail/uw-imap	<= 2004a	>= 2004b	All supported architectures

Description

A logic bug in the code handling CRAM-MD5 authentication incorrectly specifies the condition for successful authentication.

Impact

An attacker could exploit this vulnerability to authenticate as any mail user on a server with CRAM-MD5 authentication enabled.

Workaround

Disable CRAM-MD5 authentication.

Resolution

All UW IMAP users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=net-mail/uw-imap-2004b"

References

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200502-02.xml

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.