CVE-2014-4366

Vulnerability

In Apple iOS versions prior to 8, the Mail application does not check the LOGINDISABLED capability advertised by an IMAP server before sending a LOGIN command. This allows the client to transmit the user's IMAP credentials (username and password) in cleartext over the network, even when the server explicitly indicates that plaintext authentication is disabled. The affected versions include all iOS releases before 8.0.

Exploitation

An attacker with network access between the iOS device and the IMAP server can passively sniff the traffic. No authentication or user interaction is required beyond the device attempting to connect to the IMAP server. The attacker simply monitors the network for the LOGIN command, which is sent in cleartext.

Impact

Successful sniffing reveals the IMAP account credentials (username and password) in cleartext. This leads to unauthorized access to the victim's email account and potentially other services if the same credentials are reused. The compromise is limited to information disclosure of the credentials.

Mitigation

Apple addressed this issue in iOS 8, released on September 17, 2014 [1]. Users should update to iOS 8 or later. No workaround is available for earlier versions; upgrading is the only mitigation.