CVE-2005-0408

CitrusDB 0.3.6 and earlier uses an authentication cookie id_hash which is md5(user_name + 'boogaadeeboo'); because id_hash is derived from the username with a hard-coded suffix, an attacker who knows a valid username can compute the MD5 and forge the cookie to bypass authentication and gain privi...

CitrusDB Static id_hash Admin Authentication Bypass

The remote host is running CitrusDB, an open source customer database application written in PHP. The version of CitrusDB installed on the remote host uses as an authentication cookie the MD5 checksum of a username followed by the constant 'boogaadeeboo'. Knowing a valid username on the remote...

CVE-2005-0408

CitrusDB 0.3.6 and earlier generates easily predictable MD5 hashes of the user name for the idhash cookie, which allows remote attackers to bypass authentication and gain privileges by calculating the MD5 checksum of the user name combined with the "boogaadeeboo" string, which is hard-coded in th...

GLSA-200502-02 : UW IMAP: CRAM-MD5 authentication bypass

The remote host is affected by the vulnerability described in GLSA-200502-02 UW IMAP: CRAM-MD5 authentication bypass A logic bug in the code handling CRAM-MD5 authentication incorrectly specifies the condition for successful authentication. Impact : An attacker could exploit this vulnerability to...

CVE-2005-0373

Buffer overflow in digestmd5.c CVS release 1.170 also referred to as digestmda5.c, as used in the DIGEST-MD5 SASL plugin for Cyrus-SASL but not in any official releases, allows remote attackers to execute arbitrary code...

CVE-2005-0373

Buffer overflow in digestmd5.c CVS release 1.170 also referred to as digestmda5.c, as used in the DIGEST-MD5 SASL plugin for Cyrus-SASL but not in any official releases, allows remote attackers to execute arbitrary code...

CVE-2005-0198

A logic error in the CRAM-MD5 code for the University of Washington IMAP UW-IMAP server, when Challenge-Response Authentication Mechanism with MD5 CRAM-MD5 is enabled, does not properly enforce all the required conditions for successful authentication, which allows remote attackers to authenticat...

CVE-2005-0198

The CVE-2005-0198 entry corresponds to a logic error in the CRAM-MD5 authentication path of UW-IMAP/imap servers, allowing remote attackers to authenticate as arbitrary users when CRAM-MD5 is enabled. Multiple connected advisories (Debian OSV, Gentoo/OpenVAS, SuSE/NT) describe the same issue and ...

CVE-2005-0198

A logic error in the CRAM-MD5 code for the University of Washington IMAP UW-IMAP server, when Challenge-Response Authentication Mechanism with MD5 CRAM-MD5 is enabled, does not properly enforce all the required conditions for successful authentication, which allows remote attackers to authenticat...

Mandrake Linux Security Advisory : imap (MDKSA-2005:026)

A vulnerability was discovered in the CRAM-MD5 authentication in UW-IMAP where, on the fourth failed authentication attempt, a user would be able to access the IMAP server regardless. This problem exists only if you are using CRAM-MD5 authentication and have an /etc/cram-md5.pwd file. This is not...

UW IMAP: CRAM-MD5 authentication bypass

Background UW IMAP is the University of Washington IMAP toolkit which includes POP3 and IMAP daemons. Description A logic bug in the code handling CRAM-MD5 authentication incorrectly specifies the condition for successful authentication. Impact An attacker could exploit this vulnerability to...

UW-IMAP CRAM-MD5 Remote Authentication Bypass

There is a flaw in the remote UW-IMAP server which allows an authenticated user to log into the server as any user. The flaw is in the CRAM-MD5 authentication theme. An attacker, exploiting this flaw, would only need to identify a vulnerable UW-IMAP server which had enabled the CRAM-MD5...

[SA14057] UW-imapd CRAM-MD5 Authentication Bypass Vulnerability

TITLE: UW-imapd CRAM-MD5 Authentication Bypass Vulnerability SECUNIA ADVISORY ID: SA14057 VERIFY ADVISORY: http://secunia.com/advisories/14057/ CRITICAL: Moderately critical IMPACT: Security Bypass WHERE: From remote SOFTWARE: UW-imapd http://secunia.com/product/1578/ DESCRIPTION: A vulnerability...

UW-imapd CRAM-MD5 Authentication Bypass

Binary data 2568.prm...

imap-uw IMAP server CRAM-MD5 unauthorized access

It's possible to access mailboxes of different users...

siteman.noam.txt

!/usr/bin/perl -w Exploit by Noam Rathaus - Beyond Security Ltd. Exploit for the SiteMan vulnerability discovered by: "amironline452" use Digest::MD5 qwmd5 md5hex md5base64; use IO::Socket; use strict; ./siteman.pl / vulnerable.host my $Path = shift; my $Host = shift; my $Username = shift; my...

UW-imapd fails to properly authenticate users when using CRAM-MD5

Overview A vulnerablility in an authentication method for the University of Washington IMAP server could allow a remote attacker to access any user's mailbox. Description The Internet Message Access Protocol IMAP is a method of accessing electronic messages kept on a remote mail server and is...

Siteman <= 1.1.10 Remote Administrative Account Addition Exploit

No description provided by source. !/usr/bin/perl -w Exploit by Noam Rathaus - Beyond Security Ltd. Exploit for the SiteMan vulnerability discovered by: "amironline452" [email protected] use Digest::MD5 qwmd5 md5hex md5base64; use IO::Socket; use strict; ./siteman.pl / vulnerable.hos...

imap-uw -- authentication bypass when CRAM-MD5 is enabled

The CRAM-MD5 authentication support of the University of Washington IMAP and POP3 servers contains a vulnerability that may allow an attacker to bypass authentication and impersonate arbitrary users. Only installations with CRAM-MD5 support configured are affected...

Pivot 1.20 Beta 3 - admin & shell

oooo oooo oooooooo8 ooooooooooo 8888o 88 888 88 888 88 88 888o88 888oooooo 888 88 8888 888 888 o88o 88 o88oooo888 o888o Network security team nst.e-nex.com Title: Pivot 1.20 Beta 3 - admin & shell Bug found by: тёмыч Date: 9.12.2004 Pivot 1.20 Beta 3 script author: http://www.pivotlog.net google:...