UW IMAP: CRAM-MD5 authentication bypass — GLSA 200502-02

UW IMAP contains a vulnerability in the code handling CRAM-MD5 authentication allowing authentication bypass.

Package	net-mail/uw-imap on all architectures
Affected versions	<= 2004a
Unaffected versions	>= 2004b

UW IMAP is the University of Washington IMAP toolkit which includes POP3 and IMAP daemons.

A logic bug in the code handling CRAM-MD5 authentication incorrectly specifies the condition for successful authentication.

An attacker could exploit this vulnerability to authenticate as any mail user on a server with CRAM-MD5 authentication enabled.

Disable CRAM-MD5 authentication.

All UW IMAP users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=net-mail/uw-imap-2004b"

Release date
February 02, 2005

Latest revision
May 22, 2006: 02

Severity
normal

Exploitable
remote

Bugzilla entries