191 matches found
CVE-2007-1558
The APOP protocol allows remote attackers to guess the first 3 characters of a password via man-in-the-middle MITM attacks that use crafted message IDs and MD5 collisions. NOTE: this design-level issue potentially affects all products that use APOP, including 1 Thunderbird 1.x before 1.5.0.12 and...
CVE-2007-1558
The APOP protocol allows remote attackers to guess the first 3 characters of a password via man-in-the-middle MITM attacks that use crafted message IDs and MD5 collisions. NOTE: this design-level issue potentially affects all products that use APOP, including 1 Thunderbird 1.x before 1.5.0.12 and...
CVE-2007-1558
The APOP protocol allows remote attackers to guess the first 3 characters of a password via man-in-the-middle MITM attacks that use crafted message IDs and MD5 collisions. NOTE: this design-level issue potentially affects all products that use APOP, including 1 Thunderbird 1.x before 1.5.0.12 and...
CVE-2007-1558
The APOP protocol allows remote attackers to guess the first 3 characters of a password via man-in-the-middle MITM attacks that use crafted message IDs and MD5 collisions. NOTE: this design-level issue potentially affects all products that use APOP, including 1 Thunderbird 1.x before 1.5.0.12 and...
CVE-2007-1558
CVE-2007-1558 describes a cryptographic weakness in APOP authentication that lowers MITM attack cost to recover passwords. Connected advisories show this affects multiple mail clients (e.g., Thunderbird/Icedove, Iceape, fetchmail) and related POP/ALOP implementations. Debian DSA-1305-1 and CentOS...
FreeBSD : fetchmail -- insecure APOP authentication (f1c4d133-e6d3-11db-99ea-0060084a00e5)
Matthias Andree reports : The POP3 standard, currently RFC-1939, has specified an optional, MD5-based authentication scheme called 'APOP' which no longer should be considered secure. Additionally, fetchmail's POP3 client implementation has been validating the APOP challenge too lightly and accept...
Security fix for the ALT Linux 6 package fetchmail version 6.3.8-alt1
April 7, 2007 Michael Shigorin 6.3.8-alt1 - 6.3.8 + APOP was strengthened to make the CVE-2007-1558 attack harder + crash when opening the BSMTP output file failed was fixed + other fixes and improvements...
fetchmail -- insecure APOP authentication
Matthias Andree reports: The POP3 standard, currently RFC-1939, has specified an optional, MD5-based authentication scheme called "APOP" which no longer should be considered secure. Additionally, fetchmail's POP3 client implementation has been validating the APOP challenge too lightly and accepte...
claws-mail -- APOP vulnerability
CVE reports: The APOP protocol allows remote attackers to guess the first 3 characters of a password via man-in-the-middle MITM attacks that use crafted message IDs and MD5 collisions...
Debian DSA-939-1 : fetchmail - programming error
Daniel Drake discovered a problem in fetchmail, an SSL enabled POP3, APOP, IMAP mail gatherer/forwarder, that can cause a crash when the program is running in multidrop mode and receives messages without headers. The old stable distribution woody does not seem to be affected by this problem...
Alt-N MDaemon POP3 server buffer overflow
Buffer overflow on oversized username with '@' character in USER/APOP command...
CVE-2006-2346
vpopmail 5.4.14 and 5.4.15, with cleartext passwords enabled, allows remote attackers to authenticate to an account that does not have a cleartext password set by using a blank password to 1 SMTP AUTH or 2 APOP...
MailEnable POP3 Server APOP Command Remote Buffer Overflow
The remote host is running MailEnable, a commercial mail server for Windows. The POP3 server bundled with the version of MailEnable on the remote host has a buffer overflow flaw involving the APOP command that can be exploited remotely by an unauthenticated attacker to crash the affected service...
Multiple E-Post Mail Servers vulnerabilities
SMTP authentication buffer overflow, POP3 APOP authentication buffer overflow, LDAP buffer overflow, IMAP directory traversal and multiple DoS conditions...
[SECURITY] [DSA 774-1] New fetchmail packages fix arbitrary code execution
-------------------------------------------------------------------------- Debian Security Advisory DSA 774-1 [email protected] http://www.debian.org/security/ Martin Schulze August 12th, 2005 http://www.debian.org/security/faq -...
DSA-774-1 fetchmail - buffer overflow
Bulletin has no description...
CVE-2002-2078
Heap-based buffer overflow in Floositek 1 FTGate Pro 1.05 and 2 FTGate Office 1.05 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long POP3 APOP USER command...
CVE-2002-2078
A heap-based buffer overflow affects Floositek FTGate Pro 1.05 and FTGate Office 1.05. The flaw allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long POP3 APOP USER command. Exploitation details are not provided in the connected documents; no patches ...