Update German translation.

[~andy/fetchmail] / fetchmail-SA-2007-01.txt

diff --git a/fetchmail-SA-2007-01.txt b/fetchmail-SA-2007-01.txt
index 7c224f9344ef9f83c9a4b2fd263e3dad67ca818f..5a09c5b9011b170dddaf4ef8f5de3ba2f80833bf 100644 (file)
--- a/fetchmail-SA-2007-01.txt
+++ b/fetchmail-SA-2007-01.txt
@@ -1,9 +1,12 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA1
+

 fetchmail-SA-2007-01: APOP considered insecure
 
 fetchmail-SA-2007-01: APOP considered insecure
 

-Topics:                The POP3/APOP authentication, by itself, is considered broken.
+Topics:                APOP authentication insecure, fetchmail implementation lax

 
 Author:                Matthias Andree
 
 Author:                Matthias Andree

-Version:       1.0
+Version:       1.1

 Announced:     2007-04-06
 Type:          password theft when under MITM attack
 Impact:                password disclosure possible
 Announced:     2007-04-06
 Type:          password theft when under MITM attack
 Impact:                password disclosure possible


@@ -24,6 +27,7 @@ Corrected:    2007-03-18 fetchmail SVN
 ==================
 
 2007-04-06 1.0 first release
 ==================
 
 2007-04-06 1.0 first release

+2008-04-24 1.1 add --ssl to section 3. suggestion A below

 
 
 1. Background
 
 
 1. Background


@@ -44,9 +48,13 @@ control) files for fetchmail.
 The POP3 standard, currently RFC-1939, has specified an optional,
 MD5-based authentication scheme called "APOP".
 
 The POP3 standard, currently RFC-1939, has specified an optional,
 MD5-based authentication scheme called "APOP".
 

-Fetchmail's POP3 client implementation however has happily accepted
-random garbage as a POP3 server's APOP challenge, rather than insisting
-that the APOP challenge conformed to RFC-822, as required by RFC-1939.
+APOP should no longer be considered secure.
+
+Additionally, fetchmail's POP3 client implementation has been validating
+the APOP challenge too lightly and accepted random garbage as a POP3
+server's APOP challenge, rather than insisting that the APOP challenge
+conformed to RFC-822, as required by RFC-1939.
+

 This made it easier than necessary for man-in-the-middle attackers to
 retrieve by several probing and guessing the first three characters of
 the APOP secret, bringing brute forcing the remaining characters well
 This made it easier than necessary for man-in-the-middle attackers to
 retrieve by several probing and guessing the first three characters of
 the APOP secret, bringing brute forcing the remaining characters well


@@ -60,7 +68,7 @@ Either of these is currently considered sufficient.
 
 A. Only use APOP on SSL or TLS secured connections with mandatory and thorough
    certificate validation, such as fetchmail --sslproto tls1 --sslcertck
 
 A. Only use APOP on SSL or TLS secured connections with mandatory and thorough
    certificate validation, such as fetchmail --sslproto tls1 --sslcertck

-   or --sslproto ssl3 --sslcertck), or equivalent in the run control file.
+   or --ssl --sslproto ssl3 --sslcertck), or equivalent in the run control file.

 
 B. Avoid APOP and use stronger authenticators.
 
 
 B. Avoid APOP and use stronger authenticators.
 


@@ -74,16 +82,32 @@ C. If you must continue to use APOP without SSL/TLS, then install
 A. Copyright, License and Warranty
 ==================================
 
 A. Copyright, License and Warranty
 ==================================
 

-(C) Copyright 2007 by Matthias Andree, <matthias.andree@gmx.de>.
+(C) Copyright 2007, 2008 by Matthias Andree, <matthias.andree@gmx.de>.

 Some rights reserved.
 
 Some rights reserved.
 

-This work is licensed under the Creative Commons
-Attribution-NonCommercial-NoDerivs German License. To view a copy of
-this license, visit http://creativecommons.org/licenses/by-nc-nd/2.0/de/
-or send a letter to Creative Commons; 559 Nathan Abbott Way;
-Stanford, California 94305; USA.
+This work is licensed under the
+Creative Commons Attribution-NoDerivs 3.0 Germany License (CC BY-ND 3.0).
+
+To view a copy of this license, visit
+http://creativecommons.org/licenses/by-nd/3.0/de/deed.en
+or send a letter to:
+
+Creative Commons
+444 Castro Street
+Suite 900
+MOUNTAIN VIEW, CALIFORNIA 94041
+USA
+

 
 THIS WORK IS PROVIDED FREE OF CHARGE AND WITHOUT ANY WARRANTIES.
 Use the information herein at your own risk.
 
 END OF fetchmail-SA-2007-01.txt
 
 THIS WORK IS PROVIDED FREE OF CHARGE AND WITHOUT ANY WARRANTIES.
 Use the information herein at your own risk.
 
 END OF fetchmail-SA-2007-01.txt

+
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v1.4.11 (GNU/Linux)
+
+iEYEARECAAYFAk9/Yg4ACgkQvmGDOQUufZVn6wCgkC9pMA9HxXG6lgbgoixd73Tn
+Cz4AoKG+qB47vhGdXSTDDXDFgMDrMJ24
+=BKzz
+-----END PGP SIGNATURE-----