PT-2014-4430 · Imapsync · Imapsync

CVE-2014-2014 · Publicado 2014-01-15 · Atualizado 2023-06-07

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions imapsync versions prior to 1.584

Description The issue allows remote attackers to obtain credentials by sniffing the network when a certificate verification failure occurs. This happens because imapsync attempts a cleartext login when running with the --tls option.

Recommendations For versions prior to 1.584, update to version 1.584 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the --tls option until the update is applied.

Correção

Enumeração de Fraquezas

CWE-461

CWE-255

Identificadores relacionados

BDU:2014-00419

CVE-2014-2014

MGASA-2014-0106

MGASA-2014-0430

Produtos afetados

Imapsync

Referências · 26

• https://github.com/imapsync/imapsync/issues/15 · Nota
• http://openwall.com/lists/oss-security/2014/02/18/5 · Nota
• http://linux-france.org/prj/imapsync_list/msg01907.html · Nota
• http://php.net/ChangeLog-5.php#5.4.34 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-3670 · Nota
• http://linux-france.org/prj/imapsync_list/msg01910.html · Nota
• http://seclists.org/oss-sec/2014/q1/378 · Correção
• http://oracle.com/technetwork/topics/security/cpujan2014-1972949.html#AppendixJAVA · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2014-0410 · Nota de Segurança
• https://bugs.mageia.org/show_bug.cgi?id=13820 · Nota
• https://osv.dev/vulnerability/MGASA-2014-0430 · Aviso do Fabricante
• http://mandriva.com/security/advisories?name=MDVSA-2014:060 · Aviso do Fabricante
• https://osv.dev/vulnerability/MGASA-2014-0106 · Aviso do Fabricante
• https://advisories.mageia.org/MGASA-2014-0430.html · Nota de Segurança
• https://bugs.mageia.org/show_bug.cgi?id=12770 · Nota