UW IMAP: CRAM-MD5 authentication bypass

UW IMAP: CRAM-MD5 authentication bypass UW IMAP contains a vulnerability in the code handling CRAM-MD5 authentication allowing authentication bypass. uw-imap 2005-02-02 2006-05-22 79874 remote 2004b 2004a

UW IMAP is the University of Washington IMAP toolkit which includes POP3 and IMAP daemons.

A logic bug in the code handling CRAM-MD5 authentication incorrectly specifies the condition for successful authentication.

An attacker could exploit this vulnerability to authenticate as any mail user on a server with CRAM-MD5 authentication enabled.

Disable CRAM-MD5 authentication.

All UW IMAP users should upgrade to the latest version:


    # emerge --sync
    # emerge --ask --oneshot --verbose ">=net-mail/uw-imap-2004b"

US-CERT VU#702777 CVE-2005-0198 koon jaervosz vorlon078