Re: [TLS] TLS or HTTP issue?

[Nikos Mavrogiannopoulos <[e-mail]>]

Chris Newman wrote:

> 2. Having one authorized and authenticated TLS session decrypt data from
> a different TLS session.  This attack is most severe for
> SMTP+STARTTLS+BDAT (since SMTP relays typically treat all senders as
> authenticated as long as the recipient is in the local domain), but
> impacts most application protocols that have a command to "send",
> "post", "put", "set an attribute" or perform any write operation that
> can subsequently be read back.  In the case of IMAP, this can be used by
> one authorized IMAP user (someone with an account on the IMAP server) to
> potentially steal the login password of another IMAP user on the same
> server (with some IMAP client behavior caveats).

This attack is not obvious to me by this description. Can you please
elaborate?


regards,
Nikos