Home page logo

bugtraq logo Bugtraq mailing list archives

qualcomm POP server
From: davids () SECNET COM (David Sacerdote)
Date: Wed, 9 Apr 1997 16:04:56 -0600


Since CERT took up the information in the Secure Networks advisory
imap.advisory.04.02.97, as part of CA 97.09, they neglected to repeat the
section which explicitly mentions that the Qualcomm Popper, and other POP
servers not derived from the University of Washington POP server are not
vulnerable.  The consequences have ranged from queries via email to
administrators of large networks completely disabling POP, even though
they are not running vulnerable POP servers.

I remind administrators that although virtually all IMAP servers are
affected, almost no POP servers are.  Remarkably few sites run ipop2d
and ipop3d, even in comparison to the number of sites running the
University of Washington IMAP server.  None of the Qualcomm, University
of California at Berkeley, or University of California at Davis POP
servers are vulnerable, and those three seem to be by far the most widely
deployed POP servers.  Administrators are urged NOT to panic, and blindly
disable POP service for their users, but to issue the command:

telnet mail.server.machine 110

and look at the version string they see.  There is no reason whatsoever
to disable POP service unless they see some mention of the University of
Washington, as in:

+OK testing.secnet.com POP3 3.3(20) w/IMAP2 client (Comments to
MRC () CAC Washington EDU) at Wed, 9 Apr 1997 15:20:15 -0x00 (MDT)

The full text of the Secure Networks advisory on imapd and ipop3d,
published on April 2, 1997, can be found at
I urge administrators who run POP or IMAP servers who have not already
read this advisory to do so.

I would of course, much appreciate it if CERT were to undertake a policy
of issuing a credit to the initial publisher of a piece of information
somewhere in their advisory.

David Sacerdote

Version: 2.6.2


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]