[UNIX] UW-IMAP Netmailbox Name Parsing Buffer Overflow

From: SecuriTeam (support_at_securiteam.com)
Date: 10/06/05

  • Next message: SecuriTeam: "[NT] Kaspersky AntiVirus Buffer Overflow (CAB Files)" 
    To: list@securiteam.com
Date: 6 Oct 2005 15:46:23 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      UW-IMAP Netmailbox Name Parsing Buffer Overflow
    ------------------------------------------------------------------------

    SUMMARY

    " <http://www.washington.edu/imap/> UW-IMAP is a popular free IMAP service
    for Linux and UNIX systems and is distributed with various Linux
    distributions."

    A buffer overflow vulnerability in UW-IMAP netmailbox name parsing allows
    attackers to cause the product to execute arbitrary code.

    DETAILS

    Vulnerable Systems:
     * UW-IMAP Netmailbox version imap-2004c1

    Immune Systems:
     * UW-IMAP Netmailbox version imap-2004g

    The vulnerability specifically exists due to insufficient bounds checking
    on user-supplied values. The mail_valid_net_parse_work() function in
    src/c-client/mail.c is responsible for obtaining and validating the
    specified mailbox name from user-supplied data. An error in the parsing of
    supplied mailbox names will continue to copy memory after a " character
    has been parsed until another " character is found as shown below:

    long mail_valid_net_parse_work (char *name,NETMBX *mb,char *service)
    {
      int i,j;
    #define MAILTMPLEN 1024 /* size of a temporary buffer */
      char c,*s,*t,*v,tmp[MAILTMPLEN],arg[MAILTMPLEN];
        
       ...snip...
        
      if (t - v) { /* any switches or port specification? */
    1] strncpy (t = tmp,v,j); /* copy it */
        tmp[j] = '\0'; /* tie it off */

    ..

        if (*t == '"') { /* quoted string? */
    2] for (v = arg,i = 0,++t; (c = *t++) != '"';) { /* Vulnerability */
                    /* quote next character */
            if (c == '\\') c = *t++;
            arg[i++] = c;
          }

    If an attacker supplies only one " character, the function will continue
    to copy bytes to the new pointer, overflowing the stack buffer and
    resulting in arbitrary code execution.

    Successful exploitation of the vulnerability will result in the execution
    of arbitrary code with permissions of the IMAP server. The impact of this
    vulnerability is slightly reduced due to the requirement of valid
    credentials, however IMAP servers commonly are used for free webmail
    systems and other services which may give untrusted users valid
    credentials. Networks that restrict IMAP service access to trusted users
    are at low risk.

    Vendor Patch:
    "The fix is in the following patch to imap-????/src/c-client/mail.c:

    *** mail.c 2005/03/17 00:12:22 1.6
    --- mail.c 2005/09/15 16:48:46
    ***************
    *** 691,698 ****
    --- 691,700 ----
             if (c == '=') { /* parse switches which take arguments */
        if (*t == '"') { /* quoted string? */
          for (v = arg,i = 0,++t; (c = *t++) != '"';) {
    + if (!c) return NIL; /* unterminated string */
           /* quote next character */
            if (c == '\\') c = *t++;
    + if (!c) return NIL; /* can't quote NUL either */
            arg[i++] = c;
          }
          c = *t++; /* remember delimiter for later */

    CVE Information:
     <http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2933>
    CAN-2005-2933

    Disclosure Timeline:
    09/15/2005 - Initial vendor notification
    09/15/2005 - Initial vendor response
    10/04/2005 - Coordinated public disclosure

    ADDITIONAL INFORMATION

    The information has been provided by
    <mailto:idlabs-advisories@lists.idefense.com> iDEFENSE Labs Security
    Advisories.
    The original article can be found at:
    <http://www.idefense.com/application/poi/display?id=313&type=vulnerabilities> http://www.idefense.com/application/poi/display?id=313&type=vulnerabilities

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[NT] Kaspersky AntiVirus Buffer Overflow (CAB Files)"

    Relevant Pages

    • [UNIX] Trend Micro VirusWall Buffer Overflow in VSAPI Library
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... buffer overflow vulnerability in VSAPI library allows arbitrary code ... is called "vscan" which is set suid root by default. ... permissions and thus granted all local users the privilege to execute the ...
      (Securiteam)
    • [UNIX] SCO Multiple Local Buffer Overflow
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Local exploitation of a buffer overflow vulnerability in the ppp binary, ... allows attackers to gain root privileges. ...
      (Securiteam)
    • [NT] Microsoft Word 6.0/95 Document Converter Buffer Overflow (MS04-041)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... WordPad is "a word processing application that uses the MFC rich edit ... Remote exploitation of a buffer overflow vulnerability in Microsoft ... Microsoft Word format files into the Rich Text Format natively handled by ...
      (Securiteam)
    • [UNIX] Tikiwiki Command Injection and Arbitrary File Exposure Vulnerabilities
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Two security vulnerabilities have been recently discovered in Tikiwiki, ... Remote exploitation of an input validation vulnerability in Tikiwiki ... allows attackers to gain access to arbitrary files on the vulnerable ...
      (Securiteam)
    • [NT] Ipswitch Multiple Vulnerabilities (IMail IMAP LIST Command DoS, Collaboration Suite SMTP Format
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Ipswitch Multiple Vulnerabilities (IMail IMAP LIST Command DoS, ... Collaboration Suite SMTP Format String) ... Remote exploitation of a denial of service vulnerability in Ipswitch ...
      (Securiteam)