oss-security - Re: CVE request

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Mon, 3 Nov 2008 15:49:57 +0100
From: Nico Golde <oss-security+ml@...lde.de>
To: oss-security@...ts.openwall.com
Cc: coley@...re.org
Subject: Re: CVE request - uw-imap

Hi,
* Tomas Hoger <thoger@...hat.com> [2008-11-03 15:38]:
> uw-imap upstream released new version 2007d on friday, announcing it as
> security update fixing some issues in dmail and tmail utilities:
> 
> http://mailman2.u.washington.edu/pipermail/imap-uw/2008-October/002267.html
> http://mailman2.u.washington.edu/pipermail/imap-uw/2008-October/002268.html
> 
> Further digging into this, the issue seem to be a buffer overflow
> (strcpy) when handling command line arguments (overlong mailbox
> specification when utility is called with user+folder argument). This
> can have security implications in the setups where tmail is installed 
> setuid root (according to the resources I found, that's required in
> certain configurations; dmail is not expected to run under different
> user), or when one of the utilities is configured as deliver agent in
> the MTA.

Patch attached.
HTH

Nico
-- 
Nico Golde - http://www.ngolde.de - nion@...ber.ccc.de - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.

diff -Nurad uw-imap-2007b~dfsg/src/dmail/dmail.c imap-2007d/src/dmail/dmail.c
--- uw-imap-2007b~dfsg/src/dmail/dmail.c	2007-09-11 01:57:46.000000000 +0200
+++ imap-2007d/src/dmail/dmail.c	2008-10-30 22:59:39.000000000 +0100
@@ -228,7 +228,7 @@
 				/* have a mailbox specifier? */
   if (mailbox = strchr (user,'+')) {
     *mailbox++ = '\0';		/* yes, tie off user name */
-    if (!*mailbox || !strcmp ("INBOX",ucase (strcpy (tmp,mailbox))))
+    if (!*mailbox || !compare_cstring ((unsigned char *) mailbox,"INBOX"))
       mailbox = NIL;		/* user+ and user+INBOX same as user */
   }
   if (!*user) user = myusername ();
diff -Nurad uw-imap-2007b~dfsg/src/tmail/tmail.c imap-2007d/src/tmail/tmail.c
--- uw-imap-2007b~dfsg/src/tmail/tmail.c	2007-09-17 22:58:56.000000000 +0200
+++ imap-2007d/src/tmail/tmail.c	2008-10-30 22:59:39.000000000 +0100
@@ -602,11 +602,10 @@
 
 char *getusername (char *s,char **t)
 {
-  char tmp[MAILTMPLEN];
   if (*t = strchr (s,'+')) {	/* have a mailbox specifier? */
     *(*t)++ = '\0';		/* yes, tie off user name */
 				/* user+ and user+INBOX same as user */
-    if (!**t || !strcmp ("INBOX",ucase (strcpy (tmp,*t)))) *t = NIL;
+    if (!**t || !compare_cstring ((unsigned char *) *t,"INBOX")) *t = NIL;
   }
   return s;			/* return user name */
 }


[ CONTENT OF TYPE application/pgp-signature SKIPPED ]

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.