Security alert: disable CRAM-MD5 if you don't use it
Paul J Stevens <[email protected]>
| Newsgroups | gmane.mail.imap.dbmail |
|---|---|
| Message-ID | <[email protected]> |
Hi all,
It was brought to my attention that dbmail currently authenticates any
user with any password if the client issues an CRAM-MD5 authentication
exchange, while the user - which does need to exist - has it's password
stored in an encrypted format.
This affects all versions supporting cram-md5, so 3.0.0 and later.
Installations using authldap are *not* affected.
You should disable CRAM-MD5 in dbmail.conf if you store password encrypted.
A patch was already pushed to git both on dbmail.eu and github.
I'll release a patched version asap.
--
________________________________________________________________
Paul J Stevens pjstevns @ gmail, twitter, skype, linkedin
www.nfg.nl/[email protected]/+31.85.877.99.97