PT-2014-4430 · Imapsync · Imapsync

Published 2014-01-15 · Updated 2023-06-07 · CVE-2014-2014

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions imapsync versions prior to 1.584

Description The issue allows remote attackers to obtain credentials by sniffing the network when a certificate verification failure occurs. This happens because imapsync attempts a cleartext login when running with the --tls option.

Recommendations For versions prior to 1.584, update to version 1.584 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the --tls option until the update is applied.

Fix

Weakness Enumeration

CWE-461

CWE-255

Related Identifiers

BDU:2014-00419

CVE-2014-2014

MGASA-2014-0106

MGASA-2014-0430

Affected Products

Imapsync

References · 26

• http://seclists.org/oss-sec/2014/q1/378 · Patch
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2014-0410 · Security Note
• https://osv.dev/vulnerability/MGASA-2014-0430 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2014:060 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2014-0106 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2014-0430.html · Security Note
• https://lists.fedoraproject.org/pipermail/package-announce/2014-February/128293.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2014-00419 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-2014 · Security Note
• https://advisories.mageia.org/MGASA-2014-0106.html · Security Note
• https://github.com/imapsync/imapsync/issues/15 · Note
• http://openwall.com/lists/oss-security/2014/02/18/5 · Note
• http://linux-france.org/prj/imapsync_list/msg01907.html · Note
• http://php.net/ChangeLog-5.php#5.4.34 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-3670 · Note