oss-security - Re: CVE request

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [month] [year] [list]

Date: Mon, 3 Nov 2008 16:37:43 +0100
From: Nico Golde <oss-security+ml@...lde.de>
To: oss-security@...ts.openwall.com
Cc: coley@...re.org
Subject: Re: CVE request - uw-imap

Hi,
* Nico Golde <oss-security+ml@...lde.de> [2008-11-03 15:55]:
> * Tomas Hoger <thoger@...hat.com> [2008-11-03 15:38]:
> > uw-imap upstream released new version 2007d on friday, announcing it as
> > security update fixing some issues in dmail and tmail utilities:
> > 
> > http://mailman2.u.washington.edu/pipermail/imap-uw/2008-October/002267.html
> > http://mailman2.u.washington.edu/pipermail/imap-uw/2008-October/002268.html
> > 
> > Further digging into this, the issue seem to be a buffer overflow
> > (strcpy) when handling command line arguments (overlong mailbox
> > specification when utility is called with user+folder argument). This
> > can have security implications in the setups where tmail is installed 
> > setuid root (according to the resources I found, that's required in
> > certain configurations; dmail is not expected to run under different
> > user), or when one of the utilities is configured as deliver agent in
> > the MTA.
> 
> Patch attached.

Didn't notice that you have this patch in your bz.
There is also another code snippet in the diff:
diff -Nurad uw-imap-2007b~dfsg/src/c-client/smtp.c imap-2007d/src/c-client/smtp.c
--- uw-imap-2007b~dfsg/src/c-client/smtp.c      2008-01-28 23:55:14.000000000 +0100
+++ imap-2007d/src/c-client/smtp.c      2008-08-08 18:31:44.000000000 +0200
@@ -396,7 +396,8 @@
   if (stream) {                        /* send "QUIT" */
     if (stream->netstream) {   /* do close actions if have netstream */
       smtp_send (stream,"QUIT",NIL);
-      net_close (stream->netstream);
+      if (stream->netstream)   /* could have been closed during "QUIT" */
+        net_close (stream->netstream);
     }
                                /* clean up */
     if (stream->host) fs_give ((void **) &stream->host);

Looks like a null ptr dereference is possible here if smtp_send returns
smtp_fake (stream,"SMTP connection broken (command)");. Did anyone check the
security implications of this yet?

In the meantime the discoverer of this released an advisory:
http://www.bitsec.com/en/rad/bsa-081103.txt

Cheers
Nico

-- 
Nico Golde - http://www.ngolde.de - nion@...ber.ccc.de - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.

[ CONTENT OF TYPE application/pgp-signature SKIPPED ]

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.