Wu-imapd部分Mailbox属性远程缓冲区溢出漏洞

admin

0
文章

0
评论

2022-07-18 12:51:39 CNNVD漏洞来源：ZONE.CI 全球网 0 阅读模式

漏洞信息详情

Wu-imapd部分Mailbox属性远程缓冲区溢出漏洞

CNNVD编号：CNNVD-200206-092
危害等级：高危
CVE编号： CVE-2002-0379
漏洞类型：边界条件错误
发布时间： 2002-05-10
威胁类型：远程
更新时间： 2007-02-07
厂商： university_of_washington
漏洞来源： Marcell Fodor※ m.f...

漏洞简介

Wu-imapd是一款由Washington University开发的IMAP(Internet Message Access Protocol)服务实现，可使用在Linux和Unix操作系统下。 Wu-imapd在处理部分Mailbox属性请求时存在漏洞，可导致远程攻击者进行缓冲区溢出攻击，以Imapd进程的权限在目标系统上执行任意命令。攻击者可以构建不正常的获取部分邮箱属性的请求，导致服务程序产生SIG11错误。问题存在于imapd.c中： imapd.c ------- int main (int argc，char *argv[]) { unsigned long i，uid; long f; char *s，*t，*u，*v，tmp[MAILTMPLEN]; . . . else if (!strncmp (t，\"BODY[\"，5) ＆＆ (v = strchr(t+5，\'\']\'\')) ＆＆ !v[1]){ strncpy (tmp，t+5，i = v - (t+5)); . . . else if (!strncmp (t，\"BODY.PEEK[\"，10) ＆＆ (v = strchr (t+10，\'\']\'\')) ＆＆ !v[1]) { strncpy (tmp，t+10，i = v - (t+10)); . . . ------- 处理A0666 PARTIAL 1 BODY[AAA...1052bytes..AAA] 1 1 请求时会产生缓冲溢出，精心构建字符串数据可导致以imapd进程的权限在目标系统上执行任意命令。此漏洞只影响支持RFC 1730的imapd，在imapd 2001.313和imap-2001.315.默认不安装对此RFC的支持。要判断是否imapd存在此漏洞，可运行imap后执行\"x capability\"，信息如下所示：下面示例表示有漏洞的服务程序(请暂时停止imapd服务)： * PREAUTH ..... x capability * CAPABILITY IMAP4 IMAP4REV1 ... x OK CAPABILITY completed 下面示例表示不存在漏洞的服务程序： * PREAUTH ..... x capability * CAPABILITY IMAP4REV1 ... x OK CAPABILITY completed

漏洞公告

厂商补丁： Caldera ------- Caldera已经为此发布了一个安全公告(CSSA-2002-021.0)以及相应补丁:

CSSA-2002-021.0：Linux: imapd buffer overflow when fetching partial mailbox attributes

链接： http://www.caldera.com/support/security/advisories/CSSA-2002-021.0.txt

补丁下载：

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/RPMS

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/current/RPMS

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/RPMS

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/current/RPMS

补丁安装：

# rpm -Fvh package_name Conectiva --------- Conectiva已经为此发布了一个安全公告(CLA-2002:487)以及相应补丁:

CLA-2002:487：imap

链接： http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000487

补丁下载：

ftp://atualizacoes.conectiva.com.br/6.0/SRPMS/imap-2000c-10U60_3cl.src.rpm

ftp://atualizacoes.conectiva.com.br/6.0/RPMS/imap-2000c-10U60_3cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/6.0/RPMS/imap-devel-2000c-10U60_3cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/6.0/RPMS/imap-devel-static-2000c-10U60_3cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/6.0/RPMS/imap-doc-2000c-10U60_3cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/7.0/SRPMS/imap-2000c-10U70_3cl.src.rpm

ftp://atualizacoes.conectiva.com.br/7.0/RPMS/imap-2000c-10U70_3cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/7.0/RPMS/imap-devel-2000c-10U70_3cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/7.0/RPMS/imap-devel-static-2000c-10U70_3cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/7.0/RPMS/imap-doc-2000c-10U70_3cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/8/SRPMS/imap-2000c-12U8_2cl.src.rpm

ftp://atualizacoes.conectiva.com.br/8/RPMS/imap-2000c-12U8_2cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/8/RPMS/imap-devel-2000c-12U8_2cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/8/RPMS/imap-devel-static-2000c-12U8_2cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/8/RPMS/imap-doc-2000c-12U8_2cl.i386.rpm

Conectiva Linux version 6.0及以上版本的用户可以使用apt进行RPM包的更新：

- 把以下的文本行加入到/etc/apt/sources.list文件中：

rpm [cncbr] ftp://atualizacoes.conectiva.com.br 6.0/conectiva updates

(如果你不是使用6.0版本，用合适的版本号代替上面的6.0)

- 执行: apt-get update

- 更新以后，再执行: apt-get upgrade MandrakeSoft ------------ MandrakeSoft已经为此发布了一个安全公告(MDKSA-2002:034)以及相应补丁:

MDKSA-2002:034：imap

链接： http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-034.php

补丁下载：

Updated Packages:

Linux-Mandrake 7.1:

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/7.1/RPMS/imap-2000c-4.9mdk.i586.rpm

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/7.1/RPMS/imap-devel-2000c-4.9mdk.i586.rpm

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/7.1/SRPMS/imap-2000c-4.9mdk.src.rpm

Linux-Mandrake 7.2:

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/7.2/RPMS/imap-2000c-4.8mdk.i586.rpm

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/7.2/RPMS/imap-devel-2000c-4.8mdk.i586.rpm

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/7.2/SRPMS/imap-2000c-4.8mdk.src.rpm

Mandrake Linux 8.0:

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/8.0/RPMS/imap-2000c-4.7mdk.i586.rpm

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/8.0/RPMS/imap-devel-2000c-4.7mdk.i586.rpm

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/8.0/SRPMS/imap-2000c-4.7mdk.src.rpm

Mandrake Linux 8.0/ppc:

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/ppc/8.0/RPMS/imap-2000c-4.7mdk.ppc.rpm

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/ppc/8.0/RPMS/imap-devel-2000c-4.7mdk.ppc.rpm

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/ppc/8.0/SRPMS/imap-2000c-4.7mdk.src.rpm

Mandrake Linux 8.1:

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/8.1/RPMS/imap-2000c-7.1mdk.i586.rpm

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/8.1/

参考网址

来源:US-CERT Vulnerability Note: VU#961489 名称: VU#961489 链接:http://www.kb.cert.org/vuls/id/961489 来源: BUGTRAQ 名称: 20020510 wu-imap buffer overflow condition 链接:http://marc.theaimsgroup.com/?l=bugtraq&m=102107222100529&w=2 来源: XF 名称: wuimapd-authenticated-user-bo(10803) 链接:http://xforce.iss.net/xforce/xfdb/10803 来源: www.washington.edu 链接:http://www.washington.edu/imap/buffer.HTML 来源: BID 名称: 4713 链接:http://www.securityfocus.com/bid/4713 来源: REDHAT 名称: RHSA-2002:092 链接:http://www.redhat.com/support/errata/RHSA-2002-092.HTML 来源: ENGARDE 名称: ESA-20020607-013 链接:http://www.linuxsecurity.com/advisories/other_advisory-2120.HTML 来源: MANDRAKE 名称: MDKSA-2002:034 链接:http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-034.php 来源: XF 名称: wuimapd-partial-mailbox-bo(9055) 链接:http://www.iss.net/security_center/static/9055.php 来源: HP 名称: HPSBTL0205-043 链接:http://online.securityfocus.com/advisories/4167 来源: CONECTIVA 名称: CLA-2002:487 链接:http://distro.conectiva.com/atualizacoes/?id=a&anuncio=000487 来源: CALDERA 名称: CSSA-2002-021.0 链接:ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-021.0.txt