Subject: Security hole in imapd - pine 3.96 affected?

From: Rick Byers <[email-masked]>
Date: Mon, 7 Apr 1997 17:13:23 -0400 (EDT)

Hi, I just got the CERT advisory for a security hole in imapd which, when
exploited, can be used to execute arbitrary root commands.  They mention
that all versions of U of W IMAPD prior to 10 something are affected.
They then go on to say that if you're not ready to upgrade to IMAP 4rev1,
you can "download a corrected imapd as part of pine 3.96".  Pine 3.96
definantly uses a U of W imapd less than V10 (far less).  Has 3.96 just
been fixed (why isn't it 3.97?), or has 3.96 been fine all along?

Does anyone know if any earlier versions of pine imapd were effected?
We've been using 3.96 since it came out, but It would be make me feel good
if I know that no pine imapd has had that bug.

I've gone over the source code a bit, and know bufer overflow
possibilities are obvious before the setuid - but I didn't look very long
(and I'm no expert).  I just need to know how to treat this from a
security perspective - either possible root compramise (have to be
pesimistic) or not possible.  I don't want to spend the hours doing a
complete security sweep unless I'm sure there was a chance for a problem.

I'd also like to re-enable my imap server ASAP.  It would be helpfull if
someone could tell me (preferable in private e-mail for security reasons)
the exact location in imapd where the buffer overrun was possible.  I was
in the process of installing IMAPDd 4 (probably one of the bad ones), but
didn't finish.

Thanks a lot, 
	Rick

=========================================================================
Rick Byers                                      Internet Access Worldwide
[email-masked]                                System Admin, Tech Support
Welland, Ontario, Canada                                    (905)714-1400
http://www.iaw.on.ca/rickb/                         http://www.iaw.on.ca/

---

From: Mike Brudenell <[email-masked]>
Date: Tue, 8 Apr 1997 09:29:23 +0100 (BST)

I believe that the Pine 3.96 distribution's imapd kit has been fixed.
Perhaps this message from Mark Crispin (one of the Pine Team) in reply to
a previous query may be of use to you:

+---
| From [email-masked] Tue Apr  8 09:26:34 1997
| Date: Tue, 4 Mar 1997 15:22:05 -0800
| From: Mark Crispin <[email-masked]>
| To: [email-masked]
| Subject: Re: Pine 3.96
| 
| On 4 Mar 1997, Jody Housman wrote:
| > After building 3.96, I checked log_std.c code, and it appears to be the
| > same as what SNI calls the flawed code.  Has the security hole been fixed
| > in some other way such as increasing the size of the username buffer?
| 
| Yes.  Instead of changing the flawed code, there is a booby trap in 3.96
| to catch people who try to exploit it.  Attempts to trigger the security
| hole will never get to the flawed code, but will cause a "Crack attempt"
| syslog alert.  Also, the advertised banner did not change in 3.96, to make
| it difficult for a bad guy to tell the difference between a vulnerable
| 3.95 server and a non-vulnerable 3.96 server. 
| 
| Perhaps knowledge this might deter bad guys from trying to exploit this
| bug.  Then again, those of us who have a life have a hard time in
| fathoming the thought processes of those who do not. 
| 
| In the as-yet unreleased Pine 4.0 (and the current released imap-4.1
| toolkit), the banners changed, so there seemed to be no point in having
| the booby trap.  The flawed code is gone entirely in this version.
| 
| Unless you have a special reason to continue to run IMAP2bis based 
| servers, I recommend that you run the servers in the imap-4.1 toolkit:
| 	ftp://ftp.cac.washington.edu/mail/imap.tar.Z
| since this version supports IMAP4rev1 and POP3 with UIDL.
| 
| -- Mark --
| 
| Unsolicited commercial email is NOT welcome at this email address.
+---

Cheers,

-- 
Mike Brudenell                                         <[email-masked]>
------------------------------------------------------------------------
The Computing Service, University of York, Heslington, York, YO1 5DD, UK
Tel: +44-1904-433811  FAX: +44-1904-433740  http://www.york.ac.uk/~pmb1/