diff options
Diffstat (limited to 'metadata/glsa/glsa-200911-03.xml')
| -rw-r--r-- | metadata/glsa/glsa-200911-03.xml | 96 |
1 files changed, 96 insertions, 0 deletions
diff --git a/metadata/glsa/glsa-200911-03.xml b/metadata/glsa/glsa-200911-03.xml new file mode 100644 index 000000000000..7bb7298de6c7 --- /dev/null +++ b/metadata/glsa/glsa-200911-03.xml @@ -0,0 +1,96 @@ +<?xml version="1.0" encoding="utf-8"?> +<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd"> +<glsa id="200911-03"> + <title>UW IMAP toolkit: Multiple vulnerabilities</title> + <synopsis> + Multiple vulnerabilities have been found in the UW IMAP toolkit and the + c-client library, the worst of which leading to the execution of arbitrary + code. + </synopsis> + <product type="ebuild">c-client uw-imap</product> + <announced>2009-11-25</announced> + <revised count="01">2009-11-25</revised> + <bug>245425</bug> + <bug>252567</bug> + <access>remote</access> + <affected> + <package name="net-libs/c-client" auto="yes" arch="*"> + <unaffected range="ge">2007e</unaffected> + <vulnerable range="lt">2007e</vulnerable> + </package> + <package name="net-mail/uw-imap" auto="yes" arch="*"> + <unaffected range="ge">2007e</unaffected> + <vulnerable range="lt">2007e</vulnerable> + </package> + </affected> + <background> + <p> + The UW IMAP toolkit is a daemon for the IMAP and POP3 network mail + protocols. The c-client library provides an API for IMAP, POP3 and + other protocols. + </p> + </background> + <description> + <p> + Multiple vulnerabilities were found in the UW IMAP toolkit: + </p> + <ul> + <li>Aron Andersson and Jan Sahlin of Bitsec reported boundary errors in + the "tmail" and "dmail" utilities when processing overly long mailbox + names, leading to stack-based buffer overflows (CVE-2008-5005).</li> + <li>An error in smtp.c in the c-client library was found, leading to a + NULL pointer dereference vulnerability (CVE-2008-5006).</li> + <li>Ludwig + Nussel reported an off-by-one error in the rfc822_output_char() + function in the RFC822BUFFER routines in the c-client library, as used + by the UW IMAP toolkit (CVE-2008-5514).</li> + </ul> + </description> + <impact type="high"> + <p> + A remote attacker could send an e-mail to a destination mailbox name + composed of a username and '+' character followed by a long string, + possibly leading to the execution of arbitrary code. A local attacker + could gain privileges by specifying a long folder extension argument to + the tmail or dmail program. Furthermore, a remote attacker could send a + specially crafted mail message to the UW IMAP toolkit or another daemon + using the c-client library, leading to a Denial of Service. A remote + SMTP server could respond to the QUIT command with a close of the TCP + connection instead of the expected 221 response code, possibly leading + to a Denial of Service. + </p> + </impact> + <workaround> + <p> + There is no known workaround at this time. + </p> + </workaround> + <resolution> + <p> + All c-client library users should upgrade to the latest version: + </p> + <code> + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-libs/c-client-2007e"</code> + <p> + All UW IMAP toolkit users should upgrade to the latest version: + </p> + <code> + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-mail/uw-imap-2007e"</code> + </resolution> + <references> + <uri link="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5005">CVE-2008-5005</uri> + <uri link="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5006">CVE-2008-5006</uri> + <uri link="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5514">CVE-2008-5514</uri> + </references> + <metadata tag="requester" timestamp="2009-01-13T17:17:18Z"> + rbu + </metadata> + <metadata tag="submitter" timestamp="2009-01-13T17:27:25Z"> + rbu + </metadata> + <metadata tag="bugReady" timestamp="2009-11-25T13:23:47Z"> + rbu + </metadata> +</glsa> |