oss-security - CVE request

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [thread-next>] [month] [year] [list]

Date: Mon, 3 Nov 2008 15:17:06 +0100
From: Tomas Hoger <thoger@...hat.com>
To: OSS Security <oss-security@...ts.openwall.com>, coley@...re.org
Subject: CVE request - uw-imap

Hi!

uw-imap upstream released new version 2007d on friday, announcing it as
security update fixing some issues in dmail and tmail utilities:

http://mailman2.u.washington.edu/pipermail/imap-uw/2008-October/002267.html
http://mailman2.u.washington.edu/pipermail/imap-uw/2008-October/002268.html

Further digging into this, the issue seem to be a buffer overflow
(strcpy) when handling command line arguments (overlong mailbox
specification when utility is called with user+folder argument). This
can have security implications in the setups where tmail is installed 
setuid root (according to the resources I found, that's required in
certain configurations; dmail is not expected to run under different
user), or when one of the utilities is configured as deliver agent in
the MTA.

Some further info I managed to collect is in our BZ:
https://bugzilla.redhat.com/show_bug.cgi?id=469667

-- 
Tomas Hoger / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.