3571e53040
patches for easier mirroring, to eliminate a special copy, to make www.freebsd.org/security a full copy of security.freebsd.org and be eventually be the same. For now files are just sitting there. The symlinks are missing. Discussed on: www (repository location) Discussed with: simon (so)
105 lines
4 KiB
Text
105 lines
4 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-00:14 Security Advisory
|
|
FreeBSD, Inc.
|
|
|
|
Topic: imap-uw contains security vulnerabilities for "closed"
|
|
mail servers
|
|
|
|
Category: ports
|
|
Module: imap-uw
|
|
Announced: 2000-04-24
|
|
Credits: Michal Zalewski <lcamtuf@DIONE.IDS.PL>
|
|
Michal Szymanski <siva9@CLICO.PL> via BugTraq
|
|
Affects: Ports collection.
|
|
Corrected: See below.
|
|
Vendor status: Aware of the problem, no satisfactory solution provided.
|
|
FreeBSD only: NO
|
|
|
|
I. Background
|
|
|
|
imap-uw is a popular IMAP4/POP2/POP3 mail server from the University
|
|
of Washington.
|
|
|
|
II. Problem Description
|
|
|
|
There are numerous buffer overflows available to an imap user after
|
|
they have successfully logged into their mail account
|
|
(i.e. authenticated themselves by giving the correct password,
|
|
etc). Once the user logs in, imapd has dropped root privileges and is
|
|
running as the user ID of the mail account which has been logged into,
|
|
so the buffer overflow can only allow code to be executed as that
|
|
user.
|
|
|
|
Thus, the vulnerability is only relevant on a "closed" mail server,
|
|
i.e. one which does not normally allow interactive logins by mail
|
|
users. For a system which allows users to log in or execute code on
|
|
the system, there is minimal vulnerability.
|
|
|
|
Note that once a user has successfully exploited the vulnerability to
|
|
gain access to their user account they may be able to mount further
|
|
attacks against the local (or a remote) machine to upgrade their
|
|
privileges.
|
|
|
|
The imap-uw port is not installed by default, nor is it "part of
|
|
FreeBSD" as such: it is part of the FreeBSD ports collection, which
|
|
contains over 3200 third-party applications in a ready-to-install
|
|
format. The ports collection shipped with FreeBSD 4.0 contains this
|
|
problem since it was discovered after the release.
|
|
|
|
FreeBSD makes no claim about the security of these third-party
|
|
applications, although an effort is underway to provide a security
|
|
audit of the most security-critical ports.
|
|
|
|
III. Impact
|
|
|
|
A user with a mail account on the imap server can execute arbitrary
|
|
code as themselves on that machine. This is only likely to be a
|
|
security issue on "closed" mail servers which do not allow interactive
|
|
shell logins.
|
|
|
|
Only imapd is known to be vulnerable to this time - the other daemons
|
|
installed by the imap-uw port (ipop2d/ipop3d) are not known to suffer
|
|
from the same vulnerability.
|
|
|
|
If you have not chosen to install the imap-uw port/package, then your
|
|
system is not vulnerable to this problem.
|
|
|
|
IV. Workaround
|
|
|
|
1) Deinstall the imap-uw port/package, if you you have installed it.
|
|
|
|
2) If you do not specifically require imap functionality
|
|
(i.e. pop2/pop3 is sufficient) then disable the imap daemon in
|
|
/etc/inetd.conf and restart inetd (e.g. with the command 'killall -HUP
|
|
inetd')
|
|
|
|
V. Solution
|
|
|
|
Unfortunately the vulnerabilities in imapd are quite extensive and no
|
|
patch is currently available to address them. There is also no
|
|
"drop-in" replacement for imap-uw currently available in ports,
|
|
although the mail/cyrus port is another imap server which may be a
|
|
suitable replacement. Cyrus has different configuration and
|
|
operational requirements than imap-uw however, which may make it
|
|
unsuitable for many users.
|
|
|
|
Until a security audit of the imap-uw source can be completed and the
|
|
vulnerabilities patched, it is recommended that operators of "closed"
|
|
imapd servers take steps to minimize the impact of users being able to
|
|
run code on the server (i.e., by tightening the local security on the
|
|
machine to minimize the damage an intruding user can cause).
|
|
|
|
This advisory will be updated once the known vulnerabilities in
|
|
imap-uw have been addressed.
|
|
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: 2.6.2
|
|
|
|
iQCVAwUBOQTN61UuHi5z0oilAQEe9QQAhoPtcTPFYv4RSvh0x/FYe1x8J4kmvi0x
|
|
I5fFL3Am8Yfjra/ETGE/WQpGttIFluyfs7RmOc7aglJHp9Aeii9zgCU0dv+3TIZb
|
|
FA0NUpode09tfEOP4ciuL1Diae9utoPc+80mitbGFoNL1uAUj4QKWxNNCJ1K6Jyd
|
|
plUnZwIFx64=
|
|
=qaIn
|
|
-----END PGP SIGNATURE-----
|