__________________________________________________________ The U.S. Department of Energy Computer Incident Advisory Capability ___ __ __ _ ___ / | /_\ / \___ __|__ / \ \___ __________________________________________________________ INFORMATION BULLETIN UW-IMAP Vulnerability [US-CERT Vulnerability Note VU#933601] October 18, 2005 17:00 GMT Number Q-023 [REVISED 06 Dec 2005] [REVISED 25 Apr 2006] [REVISED 25 May 2006] ______________________________________________________________________________ PROBLEM: UW-IMAP contains a buffer overflow vulnerability. PLATFORM: Version imap-2004c1 Red Hat Desktop (v. 3 and v. 4) Red Hat Enterprise Linux AS, ES, WS (v. 2.1, v. 3, and v.4) Red Hat Linux Advanced Workstation 2.1 for the Itanium Processor DAMAGE: A remote, authenticated attacker may be able to execute arbitrary code on a vulnerable system. SOLUTION: Upgrade to imag-2004g. ______________________________________________________________________________ VULNERABILITY The risk is MEDIUM. A remote, authenticated attacker may be ASSESSMENT: able to execute arbitrary code on a vulnerable system. ______________________________________________________________________________ LINKS: CIAC BULLETIN: http://www.ciac.org/ciac/bulletins/q-023.shtml ORIGINAL BULLETIN: http://www.kb.cert.org/vuls/id/933601 ADDITIONAL LINKS: Red Hat Security Advisories 2005:848 and 2005:850 https://rhn.redhat.com/errata/RHSA-2005-848.html https://rhn.redhat.com/errata/RHSA-2005-850.html Red Hat Security Advisory RHSA-2006:0276-9 https://rhn.redhat.com/errata/RHSA-2006-0276.html Red Hat Security Advisory RHSA-2006:0501-6 https://rhn.redhat.com/errata/RHSA-2006-0501.html CVE: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2933 ______________________________________________________________________________ REVISION HISTORY: 12/06/2005 - added links to Red Hat Security Advisories 2005:848 and 2005:850 that provide updated packages for libc-client and imap for Red Hat 4 and Red Hat 2.1 and 3, respectively. 04/25/2006 - added a link to Red Hat Security Advisory RHSA-2006:0276-9 for Red Hat Desktop (v. 3 & 4) and Red Hat Enterprise Linux AS, ES, WS (v. 3 & 4). 05/25/2006 - added a link to Red Hat Security Advisory RHSA-2006:0501-6 for updates to Red Hat Enterprise Linux AS, ES, WS (v. 2.1) and Red Hat Linux Advanced Workstation 2.1 for the Itanium Processor. [***** Start US-CERT Vulnerability Note VU#933601 *****] Vulnerability Note VU#933601 UW-IMAP vulnerable to a buffer overflow Overview UW-IMAP contains a buffer overflow vulnerability that may allow a remote, authenticated attacker to execute arbitrary code on a vulnerable system. I. Description The University of Washington IMAP Server (UW-IMAP) is an email server that uses the Internet Message Access Protocol (lMAP). A lack of validation on user-controlled data supplied to the UW-IMAP Server may allow a buffer overflow to occur. The UW-IMAP Server expects mailbox names enclosed with quote characters ("). If a remote attacker supplies the UW-IMAP server with a mailbox name that begins with a quote character but does not have a closing quote character, the server will continue to read data until an end quote character is reached. This may overrun the buffer meant to contain the mailbox name and overwrite the stack with attacker-controlled data. II. Impact A remote, authenticated attacker may be able to execute arbitrary code on a vulnerable system. III. Solution Upgrade This vulnerability is fixed in UW-IMAP maintenance release imap-2004g. Systems Affected Vendor Status Date Updated University of Washington Vulnerable 17-Oct-2005 References http://www.auscert.org.au/5552 http://secunia.com/advisories/17062/ http://securitytracker.com/alerts/2005/Oct/1015000.html Credit This vulnerability was reported by AusCERT. AusCERT credit iDEFENSE with provding information regarding this issue. This document was written by Jeff Gennari. Other Information Date Public 10/05/2005 Date First Published 10/17/2005 12:35:14 PM Date Last Updated 10/17/2005 CERT Advisory CVE Name CAN-2005-2933 Metric 10.33 Document Revision 24 [***** End US-CERT Vulnerability Note VU#933601 *****] _______________________________________________________________________________ CIAC wishes to acknowledge the contributions of US-CERT for the information contained in this bulletin. _______________________________________________________________________________ CIAC, the Computer Incident Advisory Capability, is the computer security incident response team for the U.S. Department of Energy (DOE) and the emergency backup response team for the National Institutes of Health (NIH). CIAC is located at the Lawrence Livermore National Laboratory in Livermore, California. CIAC is also a founding member of FIRST, the Forum of Incident Response and Security Teams, a global organization established to foster cooperation and coordination among computer security teams worldwide. CIAC services are available to DOE, DOE contractors, and the NIH. CIAC can be contacted at: Voice: +1 925-422-8193 (7x24) FAX: +1 925-423-8002 STU-III: +1 925-423-2604 E-mail: ciac@ciac.org Previous CIAC notices, anti-virus software, and other information are available from the CIAC Computer Security Archive. World Wide Web: http://www.ciac.org/ Anonymous FTP: ftp.ciac.org PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing communities receive CIAC bulletins. If you are not part of these communities, please contact your agency's response team to report incidents. Your agency's team will coordinate with CIAC. The Forum of Incident Response and Security Teams (FIRST) is a world-wide organization. A list of FIRST member organizations and their constituencies can be obtained via WWW at http://www.first.org/. This document was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor the University of California nor any of their employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation or favoring by the United States Government or the University of California. The views and opinions of authors expressed herein do not necessarily state or reflect those of the United States Government or the University of California, and shall not be used for advertising or product endorsement purposes. LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC) Q-013: Vulnerabilities in Windows Shell Could Allow Remote Code Execution Q-014: Client Service for NetWare Could Allow Remote Code Execution Q-015: Vulnerability in Plug and Play Q-016: Ruby Q-017: Sun Java System Application Server May Disclose Source Code of Java Server Pages Q-018: VERITAS NetBackup Java User Interface Format String Vulnerability Q-019: Lynx Security Update Q-020: Multiple Security Vulnerabilities in Mozilla Q-021: Openldap and nss_ldap Security Update Q-022: Snort 2.4.3 Released