Subject: [[email-masked]: Re: Security hole in imapd - pine 3.96 affected?]

From: Michael Douglass <[email-masked]>
Date: Wed, 9 Apr 1997 01:42:42 -0500

Would it not be wise to also fix the flawed code as well?  The booby
trap is nice, but sometimes the mice can get around the trap and retrieve
the cheese anyways! :)

-----Forwarded message from Aleph One <[email-masked]>-----

+---
| From [email-masked] Tue Apr  8 09:26:34 1997
| Date: Tue, 4 Mar 1997 15:22:05 -0800
| From: Mark Crispin <[email-masked]>
| To: [email-masked]
| Subject: Re: Pine 3.96
|
| On 4 Mar 1997, Jody Housman wrote:
| > After building 3.96, I checked log_std.c code, and it appears to be the
| > same as what SNI calls the flawed code.  Has the security hole been fixed
| > in some other way such as increasing the size of the username buffer?
|
| Yes.  Instead of changing the flawed code, there is a booby trap in 3.96
| to catch people who try to exploit it.  Attempts to trigger the security
| hole will never get to the flawed code, but will cause a "Crack attempt"
| syslog alert.  Also, the advertised banner did not change in 3.96, to make
| it difficult for a bad guy to tell the difference between a vulnerable
| 3.95 server and a non-vulnerable 3.96 server.
|
| Perhaps knowledge this might deter bad guys from trying to exploit this
| bug.  Then again, those of us who have a life have a hard time in
| fathoming the thought processes of those who do not.
|
| In the as-yet unreleased Pine 4.0 (and the current released imap-4.1
| toolkit), the banners changed, so there seemed to be no point in having
| the booby trap.  The flawed code is gone entirely in this version.
|
| Unless you have a special reason to continue to run IMAP2bis based
| servers, I recommend that you run the servers in the imap-4.1 toolkit:
|       ftp://ftp.cac.washington.edu/mail/imap.tar.Z
| since this version supports IMAP4rev1 and POP3 with UIDL.
|
| -- Mark --
|
| Unsolicited commercial email is NOT welcome at this email address.
+---

-----End of forwarded message-----

-- 
Michael Douglass
Texas Networking, Inc.

 "The past is a foreign country; they do things differently there."
      L. P. Hartley, British author. The Go-Between, Prologue (1953).

---

From: [email-masked] (Sylvain Robitaille)
Date: 10 Apr 1997 04:44:41 GMT

>trap is nice, but sometimes the mice can get around the trap and retrieve

Actually, I believe this is exactly why Mark Crispin makes the recommendation
he makes, in the message you quoted...

[some parts snipped for clarity]

-- 
----------------------------------------------------------------------
Sylvain Robitaille
[email-masked]          http://alcor.concordia.ca/~sp_robi

I have a TINY BOWL in my HEAD
----------------------------------------------------------------------

---

From: Mark Crispin <[email-masked]>
Date: Thu, 10 Apr 1997 19:16:09 -0700

> trap is nice, but sometimes the mice can get around the trap and retrieve

This is what happened in imap-4.1.

The particular flaw was one of "function does not check to see if an
argument is ridiculously long".  That particular function, however, exists
in many variants, not all of which are distributed from here.  So, it was
faster/easier to put in the size validity check in front of the function
call than it was to try to fix all versions of the function.

In imap-4.1, that function's interface changed, so there wasn't the same
cost in rewriting/testing it as there was in Pine 3.96 (which was a
maintenance no-new-function release just to get out critical patches). 

-- Mark --

Unsolicited commercial email is NOT welcome at this email address.