Description
A logic error in the CRAM-MD5 code for the University of Washington IMAP (UW-IMAP) server, when Challenge-Response Authentication Mechanism with MD5 (CRAM-MD5) is enabled, does not properly enforce all the required conditions for successful authentication, which allows remote attackers to authenticate as arbitrary users.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 12 | uw-imap | 7:2002edebian1-6 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | imap +2 | 1:2002d-11 | RHSA-2005:128 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | uw-imap | No fix yet | — |
| Azure Linux 2 (CBL-Mariner) | uw-imap | No fix yet | — |
Advisories 1
- RHSA-2005:128 Red Hat Security Advisory: imap security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- oval:org.mitre.oval:def:11306 vdb-entry signature
- http://www.kb.cert.org/vuls/id/CRDY-68QSL5
- RHSA-2005:128 vendor-advisory
- GLSA-200502-02 vendor-advisory
- MDKSA-2005:026 vendor-advisory
- 14097 third-party-advisory
- 1013037 vdb-entry
- VU#702777 third-party-advisory
- 14057 third-party-advisory
- 12391 vdb-entry