Subject: imapd security bug?

From: "Alex Shvedov" <[email-masked]>
Date: Thu, 18 Feb 1999 11:54:13 -0500

All of a sudden I found a huge discussion of a security bug in imapd code in some other DG on

http://darwin.bio.uci.edu/~mcoogan/bugtraq/

for example, in

http://darwin.bio.uci.edu/~mcoogan/bugtraq/msg01562.html

Any opinions? Is it corrected?

I didn't go into details as yet, maybe, there's no need to, but the starting point looks serious (and it's still there in 4.5/12.249 version of mail.c/imapd.c). Here's a fragment:

"The problem code appears in the mail_auth() routine in mail.c of the IMAP server source code distribution, which reads:
...
The problem lies in the strcpy() call that copies the contents of mechanism to tmp which resides on the stack as an automatic variable.  The tmp buffer is MAILTMPLEN bytes in size, with MAILTMPLEN defined to be 1024 in mail.h. However, the command string read from the client by the server is placed
into a buffer TMPLEN bytes in size, with TMPLEN defined to be 8192 in imapd.c, thus allowing the passing of arguments to mail_auth() that greatly exceed the size of its temporary buffer."

Any response would be greatly appreciated.

Alex Shvedov.

┼Б²З+≥╚b╒v⌡╒Кm├+&j)b·	b╡ж╖v+lj╥!┼В╛╠Г║╤зЪ0а╚!┼x-╒w²╩Ь╕j÷эrX··ыb╡ьm

---

From: Mark Crispin <[email-masked]>
Date: Thu, 18 Feb 1999 10:42:01 -0800 (PST)

This was an old problem in beta versions of imap-4.1.  It was fixed in the
final imap-4.1, and is certainly fixed in imap-4.5/imapd 12.249 today.

On Thu, 18 Feb 1999 11:54:13 -0500, Alex Shvedov wrote:
> I didn't go into details as yet, maybe, there's no need to, but the starting
> point looks serious (and it's still there in 4.5/12.249 version of
> mail.c/imapd.c). Here's a fragment:
>
> "The problem code appears in the mail_auth() routine in mail.c of the IMAP
> server source code distribution, which reads: