Strengthen APOP a bit (validate RFC-822 syntax) in order to fend off

Leurent-style MITM attacks which are based on MD5 and APOP weaknesses.

svn path=/branches/BRANCH_6-3/; revision=5057

1 files changed, 14 insertions, 0 deletions

diff --git a/pop3.c b/pop3.c
index 3ba6af36..17f66c70 100644
--- a/pop3.c
+++ b/pop3.c
@@ -659,6 +659,20 @@ static int pop3_getauth(int sock, struct query *ctl, char *greeting)
 	else
 	    *++end = '\0';
 
+	/* SECURITY: 2007-03-17
+	 * Strictly validating the presented challenge for RFC-822
+	 * conformity (it must be a msg-id in terms of that standard) is
+	 * supposed to make attacks against the MD5 implementation
+	 * harder[1]
+	 *
+	 * [1] "Security vulnerability in APOP authentication",
+	 *     Gaëtan Leurent, fetchmail-devel, 2007-03-17 */
+	if (!rfc822_valid_msgid((unsigned char *)start)) {
+	    report(stderr,
+		    GT_("Invalid APOP timestamp.\n"));
+	    return PS_AUTHFAIL;
+	}
+
 	/* copy timestamp and password into digestion buffer */
 	msg = xmalloc((end-start+1) + strlen(ctl->password) + 1);
 	strcpy(msg,start);