Full Disclosure mailing list archives
Re: IpSwitch IMail Server <= ver 8.1 User Password Decryption
From: buggy () lockless com
Date: Wed, 18 Aug 2004 02:48:30 +0200
Ehlo,in fact I agree with Dave, if you have to migrate 2000 mail accounts, like I have to, you'll be glad of this "bug" ... don't forget that to decrypt the passes you need access to the machine .. so if you already in ...
cheers Fremen Dave Warren writes:
Adik wrote:IpSwitch IMail Server version up to 8.1 uses weak encryption algorithm to encrypt its user passwords. Have a look at attached proof of concept tool, which will decrypt user password from local machine instantly.Unfortunately being able to decrypt passwords is absolutely required in order to support APOP, or SMTP CRAM-MD5 authentication.With that in mind, this isn't so much a bug, but rather a design flaw necessitated to support the protocols involved.-- Dave Warren, Email/MSN MSG: dave.warren () devilsplayground net Phone: (403) 770-6140 Vonage: (817) 886-0860 Cell: (403) 371-3470 Toll free: (888) 371-3470 ICQ: 17848192 AIM: devilspgd
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- IpSwitch IMail Server <= ver 8.1 User Password Decryption Adik (Aug 16)
- Re: IpSwitch IMail Server <= ver 8.1 User Password Decryption Dave Warren (Aug 17)
- Re: IpSwitch IMail Server <= ver 8.1 User Password Decryption buggy (Aug 18)
- Re: IpSwitch IMail Server <= ver 8.1 User Password Decryption David E. Smith (Aug 19)
- <Possible follow-ups>
- RE: IpSwitch IMail Server <= ver 8.1 User Password Decryption Bill Roemhild (Aug 16)
- Re: Re: IpSwitch IMail Server <= ver 8.1 User Password Decryption andy (Aug 20)
- Re: IpSwitch IMail Server <= ver 8.1 User Password Decryption Dave Warren (Aug 17)