CVE-2007-5855: Medium severity Apple iOS and macOS vulnerability
Published Dec 19, 2007
·Updated
Mail in Apple Mac OS X 10.4.11 and 10.5.1, when an SMTP account has been set up using Account Assistant, can use plaintext authentication even when MD5 Challenge-Response authentication is available, which makes it easier for remote attackers to sniff account activity.
Affected Software
2 affected components
Apple iOS and macOS=10.5.1
Apple iOS and macOS=10.4.11
Event History
Dec 19, 2007
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Frequently Asked Questions
1
Which systems are exposed to this issue?
The issue affects Mail on Apple Mac OS X 10.4.11 and 10.5.1 when an SMTP account was configured through Account Assistant. The provided data does not establish that other account setup methods are affected.
2
What must an attacker be able to do to exploit it?
An attacker needs the ability to remotely sniff network traffic carrying SMTP account authentication. Mail may use plaintext authentication even when MD5 Challenge-Response authentication is available, exposing account activity to observation.