{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cTT\u003eUW-Imap\u003c/TT\u003e versions ant\u00e9rieures \u00e0  la version imap-2004b.",
  "content": "## Description\n\nUW-Imap est le serveur de messagerie IMAP (Internet Message Access\nProtocol) cr\u00e9\u00e9 par l\u0027universit\u00e9 de Washington.\n\nUne vuln\u00e9rabilit\u00e9 est pr\u00e9sente dans le m\u00e9canisme d\u0027authentification\nCRAM-MD5  \n(Challenge-Response Authentication Mechanism with MD5). Cette\nvuln\u00e9rabilit\u00e9 permet \u00e0 un utilisateur mal intentionn\u00e9 d\u0027acc\u00e9der \u00e0 la\nbo\u00eete aux lettres d\u0027un utilisateur sans \u00eatre authentifi\u00e9.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 des \u00e9diteurs pour l\u0027obtention des\ncorrectifs (cf. Documentation).  \n  \nLa version imap-2004b est disponible \u00e0 l\u0027adresse ci-dessous :\n\n    ftp://ftp.cac.washington.edu/mail/imap.tar.Z\n",
  "cves": [],
  "initial_release_date": "2005-03-02T00:00:00",
  "last_revision_date": "2005-06-10T00:00:00",
  "links": [
    {
      "title": "Mise \u00e0 jour de s\u00e9curit\u00e9 du paquetage NetBSD imap-uw :",
      "url": "ftp://ftp.netbsd.org/pub/NetBSD/packages/pkgsrc/mail/imap-uw/README.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 de SUSE du 01 mars 2005 :",
      "url": "http://www.novell.com/linux/security/advisories/2005_12_imap.html"
    },
    {
      "title": "Site Internet du serveur UW-Imap :",
      "url": "http://www.washington.edu/imap/"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Gentoo GLSA 200502-02 du 02 f\u00e9vrier    2005 :",
      "url": "http://www.gentoo.org/security/en/glsa/glsa-200502-02.xml"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Red Hat RHSA-2005:128 du 23 f\u00e9vrier    2005 :",
      "url": "http://rhn.redhat.com/errata/RHSA-2005-128.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Mandrake MDKSA-2005:026 du 01 f\u00e9vrier    2005 :",
      "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2005:026"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 FreeBSD \"imap-uw - authentification    bypass when CRAM-MD5 is enabled\" du 03 juin 2005 :",
      "url": "http://www.vuxml.org/freebsd"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 VU#702777 de l\u0027US-CERT du 27 janvier    2005 :",
      "url": "http://www.kb.cert.org/vuls/id/702777"
    }
  ],
  "reference": "CERTA-2005-AVI-097",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2005-03-02T00:00:00.000000"
    },
    {
      "description": "ajout de la r\u00e9f\u00e9rence au bulletin de s\u00e9curit\u00e9 NetBSD.",
      "revision_date": "2005-03-03T00:00:00.000000"
    },
    {
      "description": "ajout des r\u00e9f\u00e9rences aux bulletins de s\u00e9curit\u00e9 Gentoo, Mandrake, Red Hat, FreeBSD.",
      "revision_date": "2005-06-10T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement de l\u0027authentification"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 pr\u00e9sente dans UW-Imap permet \u00e0 un utilisateur mal\nintentionn\u00e9 d\u0027acc\u00e9der \u00e0 la bo\u00eete aux lettres d\u0027un utilisateur sans \u00eatre\nauthentifi\u00e9.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans UW-imapd",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de securit\u00e9 VU#702777 de l\u0027US-CERT",
      "url": null
    }
  ]
}