PT-2002-3038 · Apple · Mail.App

Published 2002-12-31 · Updated 2008-09-05 · CVE-2002-2326

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mail.app versions 10.0 through 10.0.4 Mail.app versions 10.1 through 10.1.5

Description The default configuration of Mail.app sends iDisk authentication credentials in cleartext when connecting to Mac.com, which could allow remote attackers to obtain passwords by sniffing network traffic.

Recommendations For Mail.app versions 10.0 through 10.0.4, update the configuration to encrypt authentication credentials. For Mail.app versions 10.1 through 10.1.5, update the configuration to encrypt authentication credentials.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2002-2326

Affected Products

Mail.App

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2002-2326 · Security Note
• http://securityfocus.com/bid/5303 · Note
• http://archives.neohapsis.com/archives/bugtraq/2002-07/0281.html · Note
• http://archives.neohapsis.com/archives/bugtraq/2002-07/0276.html · Note
• http://iss.net/security_center/static/9670.php · Note