PT-2003-1935 · Apple · Mail+1

Published 2003-10-30 · Updated 2008-09-05 · CVE-2003-0881

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Mac OS X versions prior to 10.3

Description The issue concerns the Mail application in Mac OS X, which, when configured to use MD5 Challenge Response, falls back to plaintext authentication if the CRAM-MD5 hashed login fails. This could allow remote attackers to gain privileges by sniffing the password.

Recommendations For versions prior to 10.3, consider updating to version 10.3 or later to resolve the issue. As a temporary workaround, avoid using the MD5 Challenge Response configuration in the Mail application until a patch is available. Restrict access to sensitive networks to minimize the risk of password sniffing.

Fix

Related Identifiers

CVE-2003-0881

Affected Products

Macos X

Mail

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2003-0881 · Security Note
• http://docs.info.apple.com/article.html?artnum=61798 · Vendor Advisory
• http://lists.apple.com/mhonarc/security-announce/msg00038.html · Note