Subject: SANS: Multiple IMAP client overflows

From: [email-masked] (Jim Seymour)
Date: Fri, 23 May 2003 07:13:10 -0400 (EDT)

>From the lastest SANS Security Alert Consensus reports:

    A released report indicates that many various IMAP clients are
    vulnerable to various overflows in the handling of large data amounts.
    In some cases, this leads to a denial of service (the application
    crashes); in other cases, it may lead to execution of arbitrary code.
    Vulnerable clients include Pine, Evolution, kmail, Mozilla, mutt,
    Sylpheed, Outlook Express and Eudora.

    These vulnerabilities are not confirmed.

    Source: SecurityFocus Bugtraq
    http://archives.neohapsis.com/archives/bugtraq/2003-05/0157.html

Pine, at least, uses the c-client library, right?

Regards,
Jim
-- 
Jim Seymour                  | PGP Public Key available at:
[email-masked]         | http://www.uk.pgp.net/pgpnet/pks-commands.html
http://jimsun.LinxNet.com    |

---

From: Mark Crispin <[email-masked]>
Date: Fri, 23 May 2003 06:10:59 -0700 (PDT)

> Pine, at least, uses the c-client library, right?

It does, and fortunately this problem is already fixed in the current
release versions of Pine and the c-client library.

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.