378113 - APOP challenge string should be checked strictly (CVE-2007-1558)

Status: VERIFIED DUPLICATE of bug 373973

(Thunderbird :: Security, defect)

Description

[Masahiro YAMADA]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; ja; rv:1.8.1.3) Gecko/20070309 Firefox/2.0.0.3
Build Identifier: 

AOPO challenge should be checked strictly because it causes to Password Recovery Attack.

See "Extended APOP Password Recovery Attack" at http://fse2007.uni.lu/rump.html
or http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-1558


Reproducible: Always

Steps to Reproduce:
1.Attacker places malformed APOP Server.
2.Access to malformed APOP Server using Thunderbird
3.
Actual Results:  
If Thunderbird does not check APOP challenge string strictly, attacker can recover password.

Expected Results:  
Thunderbird should check APOP challenge string strictly.


If striclty check is already implemented, this bug should be INVALID.

If you can read Japanase, see http://www.ipa.go.jp/security/vuln/documents/2007/JVN_19445002.html

Comment 1

[Masahiro YAMADA]

"APOP challenge string" in Comment #0 is <[e-mail]> in floowing example. (it is quoted from RFC1939).

            S: +OK POP3 server ready <[e-mail]>
            C: APOP mrose c4c9334bac560ecc979e58001b3e22fb
            S: +OK maildrop has 1 message (369 octets)

Comment 2

[Masahiro YAMADA]

This is quoted from http://seclists.org/bugtraq/2007/Apr/0018.html , 
------------------------------
  However, using the current techniques available to attack MD5, the
  msg-ids sent by the server can easily be distinguished from genuine
  ones as they will not respect the RFC specification. In particular,
  they will contain non-ASCII characters. Therefore, as a security
  countermeasure, mail user agents should reject msg-ids that does not
  conform to the RFC. 
-----------------------------
It is reason of this bug.

In RFC1939, Format of APOP challenge string (written as "timestamp" in RFC1939) is `msg-id' in RFC822.
In RFC822, msg-id format is
     msg-id      =  "<" addr-spec ">"            ; Unique message id
And addr-spec SHOULD contain ONLY ASCII characters (0x20 - 0x7E).

Comment 3

[Daniel Veditz [:dveditz]]

This should be fixed in the next version of Thunderbird. Thank-you