full-disclosure - Re: IpSwitch IMail Server <= ver 8.1 User Password Decryption

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: buggy at lockless.com (buggy@...kless.com)
Subject: Re: IpSwitch IMail Server <= ver 8.1 User Password
 Decryption

Ehlo,

in fact I agree with Dave, if you have to migrate 2000 mail accounts, like I 
have to, you'll be glad of this "bug" ... don't forget that to decrypt the 
passes you need access to the machine .. so if you already in ...

cheers

Fremen

Dave Warren writes:

> Adik wrote:
> 
>>IpSwitch IMail Server version up to 8.1 uses weak encryption algorithm to 
>>encrypt its user passwords. Have a look at attached proof of concept tool, which will decrypt user password from local machine instantly.
>>  
>>
> Unfortunately being able to decrypt passwords is absolutely required in 
> order to support APOP, or SMTP CRAM-MD5 authentication.
> 
> With that in mind, this isn't so much a bug, but rather a design flaw 
> necessitated to support the protocols involved.
> 
> -- 
> Dave Warren,
>  Email/MSN MSG:  dave.warren@...ilsplayground.net
>  Phone: (403) 770-6140     Vonage: (817) 886-0860
>  Cell:  (403) 371-3470  Toll free: (888) 371-3470
>  ICQ: 17848192                     AIM: devilspgd
> 
> 
> 
>