CVE-2007-1558

The APOP protocol allows remote attackers to guess the first 3 characters of a password via man-in-the-middle (MITM) attacks that use crafted message IDs and…

published April 16, 2007

CVSS
—
EPSS
2%
Percentile
84.0
In the wild
Unconfirmed
What it is

The APOP protocol allows remote attackers to guess the first 3 characters of a password via man-in-the-middle (MITM) attacks that use crafted message IDs and MD5 collisions. NOTE: this design-level issue potentially affects all products that use APOP, including (1) Thunderbird 1.x before 1.5.0.12 and 2.x before 2.0.0.4, (2) Evolution, (3) mutt, (4) fetchmail before 6.3.8, (5) SeaMonkey 1.0.x before 1.0.9 and 1.1.x before 1.1.2, (6) Balsa 2.3.16 and earlier, (7) Mailfilter before 0.8.2, and possibly other products.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02423 · 84.0th percentile
Published
2007-04-16T22:00Z
EPSS history
Timeline
  • 16 APR 22:00Z
    The APOP protocol allows remote attackers to guess the first 3 characters of a password via man-in-the-middle (MITM) attacks that use crafted message IDs and…
    cvelistv5