Bug 237293

Summary:	CVE-2007-1558: claws-mail APOP vulnerability
Product:	[Fedora] Fedora	Reporter:	Ville Skyttä <ville.skytta>
Component:	claws-mail	Assignee:	Andreas Bierfert <andreas.bierfert>
Status:	CLOSED NEXTRELEASE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	6	CC:	fedora-security-list
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2007-04-21 11:46:14 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Ville Skyttä 2007-04-20 17:22:47 UTC

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-1558

"The APOP protocol allows remote attackers to guess the first 3 characters of a
password via man-in-the-middle (MITM) attacks that use crafted message IDs and
MD5 collisions. NOTE: this design-level issue potentially affects all products
that use APOP, including (1) Thunderbird, (2) Evolution, (3) mutt, and (4)
fetchmail."

According to upstream, fixed in 2.9.1.
http://www.claws-mail.org/news.php

Comment 1 Andreas Bierfert 2007-04-21 11:46:14 UTC

Thanks for reporting. Fixed and pushed.