Subject: Pine 3.96

From: Jody Housman <[email-masked]>
Date: Tue, 4 Mar 1997 16:05:46 -0500 (EST)

We have installed Pine 3.96 which claims to have fixed the security hole
in imapd and ipopd daemons.  In the Secure Networks, Inc. advisory, it
states that the problem is with the server_login() routine which is in
log_xxx.c.  The advisory also includes the corrected code.

After building 3.96, I checked log_std.c code, and it appears to be the
same as what SNI calls the flawed code.  Has the security hole been fixed
in some other way such as increasing the size of the username buffer?

Thanks.

***************************************************************************

   Jody Housman
   Academic Computing    "/earth is 98% full.  Please delete some people."
   617-628-5000 x2632        submit requests to:  [email-masked]

***************************************************************************

---

From: Mark Crispin <[email-masked]>
Date: Tue, 4 Mar 1997 15:22:05 -0800

> in some other way such as increasing the size of the username buffer?

Yes.  Instead of changing the flawed code, there is a booby trap in 3.96
to catch people who try to exploit it.  Attempts to trigger the security
hole will never get to the flawed code, but will cause a "Crack attempt"
syslog alert.  Also, the advertised banner did not change in 3.96, to make
it difficult for a bad guy to tell the difference between a vulnerable
3.95 server and a non-vulnerable 3.96 server. 

Perhaps knowledge this might deter bad guys from trying to exploit this
bug.  Then again, those of us who have a life have a hard time in
fathoming the thought processes of those who do not. 

In the as-yet unreleased Pine 4.0 (and the current released imap-4.1
toolkit), the banners changed, so there seemed to be no point in having
the booby trap.  The flawed code is gone entirely in this version.

Unless you have a special reason to continue to run IMAP2bis based 
servers, I recommend that you run the servers in the imap-4.1 toolkit:
	ftp://ftp.cac.washington.edu/mail/imap.tar.Z
since this version supports IMAP4rev1 and POP3 with UIDL.

-- Mark --

Unsolicited commercial email is NOT welcome at this email address.