Re: CVE request - uw-imap

[Nico Golde <oss-security+ml () ngolde de>]

Hi,
* Nico Golde <oss-security+ml () ngolde de> [2008-11-03 15:55]:
> * Tomas Hoger <thoger () redhat com> [2008-11-03 15:38]:
> > uw-imap upstream released new version 2007d on friday, announcing it as
> > security update fixing some issues in dmail and tmail utilities:
> >
> > http://mailman2.u.washington.edu/pipermail/imap-uw/2008-October/002267.html
> > http://mailman2.u.washington.edu/pipermail/imap-uw/2008-October/002268.html
> >
> > Further digging into this, the issue seem to be a buffer overflow
> > (strcpy) when handling command line arguments (overlong mailbox
> > specification when utility is called with user+folder argument). This
> > can have security implications in the setups where tmail is installed 
> > setuid root (according to the resources I found, that's required in
> > certain configurations; dmail is not expected to run under different
> > user), or when one of the utilities is configured as deliver agent in
> > the MTA.
>
> Patch attached.

Didn't notice that you have this patch in your bz.
There is also another code snippet in the diff:
diff -Nurad uw-imap-2007b~dfsg/src/c-client/smtp.c imap-2007d/src/c-client/smtp.c
--- uw-imap-2007b~dfsg/src/c-client/smtp.c      2008-01-28 23:55:14.000000000 +0100
+++ imap-2007d/src/c-client/smtp.c      2008-08-08 18:31:44.000000000 +0200
@@ -396,7 +396,8 @@
   if (stream) {                        /* send "QUIT" */
     if (stream->netstream) {   /* do close actions if have netstream */
       smtp_send (stream,"QUIT",NIL);
-      net_close (stream->netstream);
+      if (stream->netstream)   /* could have been closed during "QUIT" */
+        net_close (stream->netstream);
     }
                                /* clean up */
     if (stream->host) fs_give ((void **) &stream->host);

Looks like a null ptr dereference is possible here if smtp_send returns
smtp_fake (stream,"SMTP connection broken (command)");. Did anyone check the
security implications of this yet?

In the meantime the discoverer of this released an advisory:
http://www.bitsec.com/en/rad/bsa-081103.txt

Cheers
Nico

-- 
Nico Golde - http://www.ngolde.de - nion () jabber ccc de - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.

Attachment: _bin
Description: