|
APOP Protocol Insecure MD5 Hash Weakness
Applications that implement the APOP protocol may be vulnerable to a password-hash weakness. This issue occurs because the MD5 hash algorithm fails to properly prevent collisions. Attackers may exploit this issue in man-in-the-middle attacks to potentially gain access to the first three characters of passwords. This will increase the likelihood of successful brute-force attacks against APOP authentication. To limit the possibility of successful exploits, applications that implement the APOP protocol should set up safeguards to ensure that message IDs are RFC-compliant. Mozilla Thunderbird, Evolution, mutt, and fetchmail are reportedly affected by this issue. |
|
 Privacy Statement |
