Yahoo's Zimbra client has a security hole so big you can fly an entire Borg collective through the middle of it and not worry about the cubes touching the sides.
According to Holden Karau, for some reason the passwords used to access Yahoo mail through the Zimbra client are sent over the Internet in clear text.
Writing in his bog, Karau said that he stumbled upon this problem while participating in the Yahoo Hack Day at the University of Waterloo.
Yahoo imap servers used by the Yahoo Desktop don't support SSL and the password was being transmitted in plain text, he said.
It means that If you use Zimbra to access your Yahoo mail, you almost certainly need to change your password and stop using Zimbra immediately especially if you've ever done so over wireless, Karau warned.
Karau warned Yahoo about the problem during his presentation, but no one seemed to give a toss.
A Zimbra spokesperson said that the problem had already been addressed in code, and a fix is in the next release. Yahoo said it would look into it now the press had got hold of it. ยต
Yahoo Mail has huge hole
By
Nick Farrell
on
Oct 2, 2008 12:15PM

Yahoo's Zimbra client has a security hole so big you can fly an entire Borg collective through the middle of it and not worry about the cubes touching the sides.
Got a news tip for our journalists? Share it with us anonymously here.
Sponsored Whitepapers
Planning before the breach: You can’t protect what you can’t see
Beyond FTP: Securing and Managing File Transfers
NextGen Security Operations: A Roadmap for the Future

Video: Watch Juniper talk about its Aston Martin partnership
Don’t pay the ransom: A three-step guide to ransomware protection