diff options
| author | Matthias Andree <matthias.andree@gmx.de> | 2007-03-18 01:24:22 +0000 |
|---|---|---|
| committer | Matthias Andree <matthias.andree@gmx.de> | 2007-03-18 01:24:22 +0000 |
| commit | 321d61b215169346708da3ad2b74711996771635 (patch) | |
| tree | 2d214a6b6ea2a9e02dd15261fad62af157f7d2cf /NEWS | |
| parent | a59128a9369bc21df6485ddd548964a7345d1008 (diff) | |
| download | fetchmail-321d61b215169346708da3ad2b74711996771635.tar.gz fetchmail-321d61b215169346708da3ad2b74711996771635.tar.bz2 fetchmail-321d61b215169346708da3ad2b74711996771635.zip | |
Strengthen APOP a bit (validate RFC-822 syntax) in order to fend off
Leurent-style MITM attacks which are based on MD5 and APOP weaknesses.
svn path=/branches/BRANCH_6-3/; revision=5057
Diffstat (limited to 'NEWS')
| -rw-r--r-- | NEWS | 11 |
1 files changed, 11 insertions, 0 deletions
@@ -44,6 +44,17 @@ be removed from a 6.4.0 or newer release.) fetchmail 6.3.8 (not yet released): +# SECURITY STRENGTHENING: +* Make the APOP challenge parser more distrustful and have it reject challenges + that do not conform to RFC-822 msg-id format, in the hope to make mounting + man-in-the-middle attacks (MITM) against APOP a bit more difficult. + + APOP is claimed insecure by Gaëtan Leurent for MITM scenarios for typical + setups: based on MD5 collisions, it is purportedly possible to recover the + first three characters of the shared secret (password), which would then make + recovery of the shared secret a matter of hours or minutes; this would then + enable the attacker to impersonate the client vis-à-vis the server. + # BUG FIXES: * Fix pluralization of oversized-message warning mails. * Fix manual page: --sslcheck -> --sslcertck, and do not set trailing |