Home page logo

bugtraq logo Bugtraq mailing list archives

Re: IpSwitch IMail Server <= ver 8.1 User Password Decryption
From: Dave Warren <dave.warren () devilsplayground net>
Date: Tue, 17 Aug 2004 04:37:59 -0600

Adik wrote:

IpSwitch IMail Server version up to 8.1 uses weak encryption algorithm to encrypt its user passwords. Have a look at attached proof of concept tool, which will decrypt user password from local machine instantly.
Unfortunately being able to decrypt passwords is absolutely required in order to support APOP, or SMTP CRAM-MD5 authentication.

With that in mind, this isn't so much a bug, but rather a design flaw necessitated to support the protocols involved.

Dave Warren,
Email/MSN MSG:  dave.warren () devilsplayground net
Phone: (403) 770-6140     Vonage: (817) 886-0860
Cell:  (403) 371-3470  Toll free: (888) 371-3470
ICQ: 17848192                     AIM: devilspgd

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]