Secunia

A vulnerability has been reported in University of Washington IMAP server, which can be exploited by malicious people to bypass the user authentication.

The vulnerability is caused due to a logic error in the CRAM-MD5 (Challenge-Response Authentication Mechanism with MD5) authentication method when evaluating the conditions of successful authentication. This can be exploited to gain access to arbitrary users' mailboxes.

Successful exploitation requires that CRAM-MD5 authentication has been enabled (not default setting).

Solution
Update to imap-2004b or later.
Further details available in Customer Area

Provided and/or discovered by
Reported by vendor.

Changelog
Further details available in Customer Area

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area