1. Gentoo Linux Security Advisory
| Advisory Reference | GLSA 200502-02 / uw-imap |
| Release Date | February 02, 2005 |
| Latest Revision | May 22, 2006: 02 |
| Impact | normal |
| Exploitable | remote |
| Package | Vulnerable versions | Unaffected versions | Architecture(s) |
| net-mail/uw-imap | <= 2004a | >= 2004b | All supported architectures |
Related bugreports: #79874
UW IMAP contains a vulnerability in the code handling CRAM-MD5 authentication allowing authentication bypass.
UW IMAP is the University of Washington IMAP toolkit which includes POP3 and IMAP daemons.
A logic bug in the code handling CRAM-MD5 authentication incorrectly specifies the condition for successful authentication.
An attacker could exploit this vulnerability to authenticate as any mail user on a server with CRAM-MD5 authentication enabled.
Disable CRAM-MD5 authentication.
All UW IMAP users should upgrade to the latest version:
Code Listing 3.1: Resolution |
# emerge --sync # emerge --ask --oneshot --verbose ">=net-mail/uw-imap-2004b" |