Bugzilla Bug 175022

The APOP protocol allows remote attackers to guess the first 3 characters of a
password via man-in-the-middle (MITM) attacks that use crafted message IDs and
MD5 collisions.

From fetchmail-6.3.8's changelog:

fetchmail 6.3.8 (released 2007-04-06):

# SECURITY STRENGTHENING:
* Make the APOP challenge parser more distrustful and have it reject challenges
  that do not conform to RFC-822 msg-id format, in the hope to make mounting
  man-in-the-middle attacks (MITM) against APOP a bit more difficult.
  (CVE-2007-1558, reported by Gaëtan Leurent, published 2007-04-02 on Bugtraq)

  APOP is claimed insecure by Gaëtan Leurent for MITM scenarios for typical
  setups: based on MD5 collisions, it is purportedly possible to recover the
  first three characters of the shared secret (password), which would then make
  recovery of the shared secret a matter of hours or minutes; this would then
  enable the attacker to impersonate the client vis-à-vis the server.

  For further details, check
  * Gaëtan Leurent, "Message Freedom in MD4 and MD5 Collisions: Application
  to APOP", Fast Software Encryption 2007, Luxembourg. (Proceedings to appear
in
  Springer's Lecture Notes on Computer Science.)
  * The mailing list discussion thread at
  <http://lists.berlios.de/pipermail/fetchmail-devel/2007-March/000887.html>

Um, I forgot to mention that 6.3.8 has been in the tree for quite some time
now...

Thx Ticho.

Arches please test and mark stable. Target keywords are:

fetchmail-6.3.8.ebuild:KEYWORDS="alpha amd64 arm hppa ia64 mips ppc ppc64 s390
sh sparc x86 ~x86-fbsd"

ia64 + x86 stable

sparc stable.

amd64 stable

ppc64 stable

Stable for HPPA.

Alpha done.

ppc stable, ready for GLSA voting

voting NO. 3 chars != full password, if someone uses a 3 chars password he has
more serious problems to worry about :)

Voting NO and closing. Feel free to reopen if you disagree.

mips stable.