SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (E-mail Server)  >   Courier Mail Server Vendors:   Double Precision, Inc.
(Gentoo Issues Fix) Courier-IMAP Format String Flaw in auth_debug() Lets Remote Users Execute Arbitrary Code
SecurityTracker Alert ID:  1011005
SecurityTracker URL:  http://securitytracker.com/id/1011005
CVE Reference:   CVE-2004-0777   (Links to External Site)
Date:  Aug 20 2004
Impact:   Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): Prior to Courier 0.46; Courier-IMAP 1.6.0 to 2.2.1
Description:   iDEFENSE reported a format string vulnerability in Courier-IMAP. A remote user can execute arbitrary code on the target system.

It is reported that the auth_debug() function in 'authlib/debug.c' contains an fprintf() statement that does not include the proper formatting string and processes user-supplied data.

The vulnerable function is called only if login debugging is enabled and the 'DEBUG_LOGIN' value is set to either '1' or '2' in the imapd configuration file.

The original advisory is available at:

http://www.idefense.com/application/poi/display?id=3D131&type=vulnerabilities

Impact:   A remote user can execute arbitrary code on the target system with the privileges of the Courier-IMAP process.
Solution:   Gentoo has released a fix and indicates that all courier-imap users should upgrade to the latest version:

# emerge sync

# emerge -pv ">=net-mail/courier-imap-3.0.5"
# emerge ">=net-mail/courier-imap-3.0.5"

Vendor URL:  www.courier-mta.org/ (Links to External Site)
Cause:   Input validation error, State error
Underlying OS:  Linux (Gentoo)

Message History:   This archive entry is a follow-up to the message listed below.
Aug 18 2004 Courier-IMAP Format String Flaw in auth_debug() Lets Remote Users Execute Arbitrary Code



 Source Message Contents

Subject:  [gentoo-announce] [ GLSA 200408-19 ] courier-imap: Remote Format String Vulnerability



--J2SCkAp4GZ/dPZZf
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 200408-19
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                            http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

  Severity: High
     Title: courier-imap: Remote Format String Vulnerability
      Date: August 19, 2004
      Bugs: #60865
        ID: 200408-19

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

There is a format string vulnerability in non-standard configurations
of courier-imapd which may be exploited remotely. An attacker may be
able to execute arbitrary code as the user running courier-imapd
(oftentimes root).

Background
==========

Courier-IMAP is an IMAP server which is part of the Courier mail
system. It provides access only to maildirs.

Affected packages
=================

    -------------------------------------------------------------------
     Package                /   Vulnerable   /              Unaffected
    -------------------------------------------------------------------
  1  net-mail/courier-imap      <= 3.0.2-r1                   >= 3.0.5

Description
===========

There is a format string vulnerability in the auth_debug() function
which can be exploited remotely, potentially leading to arbitrary code
execution as the user running the IMAP daemon (oftentimes root). A
remote attacker may send username or password information containing
printf() format tokens (such as "%s"), which will crash the server or
cause it to execute arbitrary code.

This vulnerability can only be exploited if DEBUG_LOGIN is set to
something other than 0 in the imapd config file.

Impact
======

If DEBUG_LOGIN is enabled in the imapd configuration, a remote attacker
may execute arbitrary code as the root user.

Workaround
==========

Set the DEBUG_LOGIN option in /etc/courier-imap/imapd to 0. (This is
the default value.)

Resolution
==========

All courier-imap users should upgrade to the latest version:

    # emerge sync

    # emerge -pv ">=net-mail/courier-imap-3.0.5"
    # emerge ">=net-mail/courier-imap-3.0.5"

References
==========

  [ 1 ] iDEFENSE Advisory
        http://www.idefense.com/application/poi/display?id=131&type=vulnerabilities&flashstatus=true

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

    http://security.gentoo.org/glsa/glsa-200408-19.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2004 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/1.0

--J2SCkAp4GZ/dPZZf
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFBJTZPaIxeYlQMsxsRAqeRAKCERHzuXVcP20rVndsvFTOcwKjIGwCfZ0Yf
c8kHndPJ/+JgtdS+9MgMwOA=
=NgPv
-----END PGP SIGNATURE-----

--J2SCkAp4GZ/dPZZf--

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC