Authen::SASL::Perl::DIGEST_MD5 versions before
2.2100 for Perl accept replayed authentication
responses via unverified nonce in server_step.
server_start generates a fresh nonce and sends it
in the challenge, and nothing later compares that
value against the nonce the client returns.
server_step derives the expected digest from the
client's own parameters, so a response verifies
whenever its digest matches the nonce it carries.
The count table it also checks is keyed on the
client-supplied nonce and starts empty in each new
server object, so a captured first response,
carrying `nc=00000001`, passes that too. RFC 2831
defines the nonce in the response as the value the
server sent in the preceding challenge. An
attacker who observes one successful `qop=auth`
exchange can replay the captured response against
a later session for the same service, host, realm
and user, and authenticate as that user without
knowing the password.