vendor:
IMail
by:
Matt Conover
5.5
CVSS
MEDIUM
Weak Password Encryption
326
CWE
Product Name: IMail
Affected Version From:
Affected Version To:
Patch Exists: NO
Related CWE:
CPE: a:ipswitch:imail
Platforms Tested: Windows
IMail Weak Password Encryption Vulnerability
IMail keeps the encrypted passwords for email accounts in a weak encryption scheme. The scheme involves converting each letter of the account name and password to their ASCII equivalent, applying offsets and differences, and looking up the new ASCII values in a table to obtain the encrypted password.
Mitigation:
Update to a newer version of IMail that uses a stronger password encryption scheme. Alternatively, consider using a different email server software that employs stronger encryption methods.
