|
UW-imapd "tmail" and "dmail" Buffer Overflow Vulnerabilities
|
|
Secunia Advisory:
|
SA32483
|
|
|
Release Date:
|
2008-11-03
|
|
Last Update:
|
2008-11-11
|
|
Popularity:
|
1,235 views
|
|
|
Critical:
|
Moderately critical
|
|
Impact:
|
Privilege escalation
System access
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Patch
|
|
| Software: | UW-imapd
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
| CVE reference: | CVE-2008-5005
|
|
Description:
Two vulnerabilities have been reported in UW-imapd, which can be exploited by malicious, local users to potentially gain escalated privileges, and by malicious people to potentially compromise a vulnerable system.
1) A boundary error in the "tmail" utility when processing overly long mailbox names (over 1024 bytes) can be exploited to cause a stack-based buffer overflow.
NOTE: The vulnerability may allow a local user to execute arbitrary code with root privileges if the utility is installed set-uid root.
2) A boundary error in the "dmail" utility when processing overly long mailbox names (over 1024 bytes) can be exploited to cause a stack-based buffer overflow.
Successful exploitation of the vulnerabilities may allow execution of arbitrary code, but requires that the utilities are configured as a delivery backend for a mail transfer agent allowing overly long destination mailbox names.
The vulnerabilities are reported in versions prior to 2007d.
Solution:
Update to version 2007d.
ftp://ftp.cac.washington.edu/imap
Provided and/or discovered by:
Aron Andersson and Jan Sahlin, Bitsec
Changelog:
2008-11-04: Added reporter link to the "Original Advisory" section. Updated credits.
2008-11-11: Added CVE reference.
Original Advisory:
UW-imapd:
http://mailman2.u.washington.edu/pipermail/imap-uw/2008-October/002267.html
http://mailman2.u.washington.edu/pipermail/imap-uw/2008-October/002268.html
Bitsec:
http://www.bitsec.com/en/rad/bsa-081103.txt
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
