Actually anyone who is on the NT Bug TraQ list was already aware of this
several months ago. there was a small discussion about it over the summer
as I recall.
Anthony
----- Original Message -----
From: "Andrew Cook" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Tuesday, December 21, 1999 10:06 PM
Subject: RE: [IMail Forum] [w00giving '99 #11] IMail's password encryption
scheme
> Come on now - don't shoot the messenger! If Ipswitch uses poor encryption
> and doesn't suggest how to protect the registry keys, I'm all for this
info.
> I would rather be informed than ignorant of an issue.
>
> Andrew
>
> -----Original Message-----
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED]]On Behalf Of Scott Pouliot
> Sent: Tuesday, December 21, 1999 9:58 PM
> To: [EMAIL PROTECTED]
> Subject: RE: [IMail Forum] [w00giving '99 #11] IMail's password
> encryption scheme
>
>
> Can I ask what would possess you to post this in an open forum?
>
> -----Original Message-----
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED]]On Behalf Of Mike
> Sent: Tuesday, December 21, 1999 9:52 PM
> To: [EMAIL PROTECTED]
> Subject: [IMail Forum] [w00giving '99 #11] IMail's password encryption
> scheme
>
>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> In case we don't have the other advisories prepared in time:
> Merry Christmas, Happy Hanukkah, and Happy New Years!
>
> w00w00 Security Development (WSD)
> http://www.w00w00.org/advisories.html
>
> - ----------------------------------------------------------------------
> - -----
> Discovered by: Mike Davis ([EMAIL PROTECTED])
>
> DESCRIPTION
> IMail is (among others) a POP3 daemon for Microsoft Windows NT. Any
> user
> who can login to the machine with the IMail database can also
> retrieve the
> encrypted passwords for ANY user. All they need to do is open a
> registry
> editor (i.e., regedit.exe).
>
>
> Please visit http://www.ipswitch.com/support/mailing-lists.html
> to be removed from this list.
>
> Please visit http://www.ipswitch.com/support/mailing-lists.html
> to be removed from this list.
>
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
