Subject: vulnerability and fix in UW imapd

From: Mark Crispin <[email-masked]>
Date: Thu, 27 Jan 2005 14:23:14 -0800 (Pacific Standard Time)

Problem:

Versions of UW imapd released prior to January 4, 2005 fail to properly 
authenticate users when using CRAM-MD5 SASL authentication.

Details:

The University of Washington IMAP server features multiple user 
authentication methods, including the Challenge-Response Authentication 
Mechanism with MD5 (CRAM-MD5) as defined by RFC2195.  A logic error in the 
code that handles CRAM-MD5 incorrectly specifies the conditions of 
successful authentication.  This error results in a vulnerability that 
could allow a remote attacker to successfully authenticate as any user on 
the target system.

Impact limitation:

This vulnerability ONLY affects sites that have explicitly enabled 
CRAM-MD5 style authentication by creating an /etc/cram-md5.pwd file. 
CRAM-MD5 style authentication is NOT enabled in the default configuration 
of UW imapd.

Consequently, sites which do not use CRAM-MD5 style authentication (the 
majority of UW imapd sites) are NOT vulnerable.  An IMAP server which does 
not advertise CRAM-MD5 style authentication is NOT vulnerable.

Workaround:

If the site uses CRAM-MD5 style authentication, delete or rename the 
/etc/cram-md5.pwd file to some other name.  Note that doing so will revert 
all passwords to those in the UNIX password system.

Solution:

This problem is fixed in the January 4, 2005 release version of imap-2004b 
and in all subsequent versions (the current release version is 
imap-2004c1).  This problem is also fixed in the UW imapd version bundled 
with Pine version 4.62.

The current release version of UW imapd is available at:
 	ftp://ftp.cac.washington.edu/mail/imap.tar.Z

The current release version of Pine is available at:
 	http://www.washington.edu/pine/getpine
 	ftp://ftp.cac.washington.edu/pine/

For more details about this issue, please refer to:
 	http://www.kb.cert.org/vuls/id/702777

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.
Si vis pacem, para bellum.
-- 
------------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/imap/c-client-list.html
------------------------------------------------------------------