- case P_APOP:
- /* build MD5 digest from greeting timestamp + password */
- /* find start of timestamp */
- for (start = greeting; *start != 0 && *start != '<'; start++)
- continue;
- if (*start == 0) {
- report(stderr,
- GT_("Required APOP timestamp not found in greeting\n"));
- return(PS_AUTHFAIL);
- }
-
- /* find end of timestamp */
- for (end = start; *end != 0 && *end != '>'; end++)
- continue;
- if (*end == 0 || end == start + 1) {
- report(stderr,
- GT_("Timestamp syntax error in greeting\n"));
- return(PS_AUTHFAIL);
- }
- else
- *++end = '\0';
-
- /* SECURITY: 2007-03-17
- * Strictly validating the presented challenge for RFC-822
- * conformity (it must be a msg-id in terms of that standard) is
- * supposed to make attacks against the MD5 implementation
- * harder[1]
- *
- * [1] "Security vulnerability in APOP authentication",
- * Gaƫtan Leurent, fetchmail-devel, 2007-03-17 */
- if (!rfc822_valid_msgid((unsigned char *)start)) {
- report(stderr,
- GT_("Invalid APOP timestamp.\n"));
- return PS_AUTHFAIL;
- }
-
- /* copy timestamp and password into digestion buffer */
- msg = (char *)xmalloc((end-start+1) + strlen(ctl->password) + 1);
- strcpy(msg,start);
- strcat(msg,ctl->password);
- strcpy((char *)ctl->digest, MD5Digest((unsigned char *)msg));
- free(msg);
-
- ok = gen_transact(sock, "APOP %s %s", ctl->remotename, (char *)ctl->digest);
- break;
-
- case P_RPOP:
- if ((ok = gen_transact(sock,"USER %s", ctl->remotename)) == 0) {
- strlcpy(shroud, ctl->password, sizeof(shroud));
- ok = gen_transact(sock, "RPOP %s", ctl->password);
- memset(shroud, 0x55, sizeof(shroud));
- shroud[0] = '\0';
- }
- break;
-