Message-ID: <20041123190133.GA19142@box79162.elkhouse.de>
From: martin.pitt at canonical.com (Martin Pitt)
Subject: [USN-31-1] cyrus21-imapd vulnerabilities

===========================================================
Ubuntu Security Notice USN-31-1           November 23, 2004
cyrus21-imapd vulnerabilities
CAN-2004-1012, CAN-2004-1013,
http://security.e-matters.de/advisories/152004.html
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 4.10 (Warty Warthog)

The following packages are affected:

cyrus21-imapd

The problem can be corrected by upgrading the affected package to
version 2.1.16-6ubuntu0.1. In general, a standard system upgrade is
sufficient to effect the necessary changes.

Details follow:

Stefan Esser discovered several buffer overflows in the Cyrus IMAP
server. Due to insufficient checking within the argument parser of
the "partial" and "fetch" commands, an argument like "body[p" was
detected as "body.peek". This could cause a buffer overflow which
could be exploited to execute arbitrary attacker-supplied code.

This update also fixes an exploitable buffer overflow that could be
triggered in situations when memory allocation fails (i. e. when no
free memory is available any more).

Both vulnerabilities can lead to privilege escalation to root.

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-imapd_2.1.16-6ubuntu0.1.diff.gz
      Size/MD5:   234979 f254486e886fa85a76b2535f0d502016
    http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-imapd_2.1.16-6ubuntu0.1.dsc
      Size/MD5:     1040 85b0b97ad9ab8b67426114158126f1de
    http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-imapd_2.1.16.orig.tar.gz
      Size/MD5:  1687454 8f4ff803a910d0f4e4cfab3b13a6080d

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-admin_2.1.16-6ubuntu0.1_all.deb
      Size/MD5:    87850 80e34d6e5fea0c7b8ed2553ce961afdc
    http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-doc_2.1.16-6ubuntu0.1_all.deb
      Size/MD5:   206492 85d547e5d130e27783428b44ff1be1c5

  amd64 architecture (Athlon64, Opteron, EM64T Xeon)

    http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-clients_2.1.16-6ubuntu0.1_amd64.deb
      Size/MD5:   106934 0fa30f41ad7648613e9ae3b0a7c66b94
    http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-common_2.1.16-6ubuntu0.1_amd64.deb
      Size/MD5:  2071388 1e8de398184325db3d3d83c6c7d858c4
    http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-dev_2.1.16-6ubuntu0.1_amd64.deb
      Size/MD5:   267958 ec6a173cc4cacdc7ca1b065b4e9403c6
    http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-imapd_2.1.16-6ubuntu0.1_amd64.deb
      Size/MD5:   591194 f972a251e2490cbb61b4b44190cf39b4
    http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-murder_2.1.16-6ubuntu0.1_amd64.deb
      Size/MD5:   526738 6901a198e350b6d3ba4a8c646177a0ee
    http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-pop3d_2.1.16-6ubuntu0.1_amd64.deb
      Size/MD5:    93078 ee6c85476f63f7a208518806c3a3f5f2
    http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/libcyrus-imap-perl21_2.1.16-6ubuntu0.1_amd64.deb
      Size/MD5:   137652 c8100718ef12d7cc82b6e5ab36cb0883

  i386 architecture (x86 compatible Intel/AMD)

    http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-clients_2.1.16-6ubuntu0.1_i386.deb
      Size/MD5:   104102 f372a3f41f5f7d436f6b6fca85c8add6
    http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-common_2.1.16-6ubuntu0.1_i386.deb
      Size/MD5:  1949328 1cad157239aa79e4b6adbdce5d980e64
    http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-dev_2.1.16-6ubuntu0.1_i386.deb
      Size/MD5:   261398 568e017d51c76e48316faf0e28de8318
    http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-imapd_2.1.16-6ubuntu0.1_i386.deb
      Size/MD5:   561756 6e9f695212413fa58cd928102e8221ab
    http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-murder_2.1.16-6ubuntu0.1_i386.deb
      Size/MD5:   493322 feb26f26e6092349a525ab8a2ab1854c
    http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-pop3d_2.1.16-6ubuntu0.1_i386.deb
      Size/MD5:    85210 db0eee22d2ec621dcd5783872baf9985
    http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/libcyrus-imap-perl21_2.1.16-6ubuntu0.1_i386.deb
      Size/MD5:   133702 9075c381787315d36dd759f91de6a72d

  powerpc architecture (Apple Macintosh G3/G4/G5)

    http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-clients_2.1.16-6ubuntu0.1_powerpc.deb
      Size/MD5:   106734 c82df404b7a3ae83c39e2557c19b78ca
    http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-common_2.1.16-6ubuntu0.1_powerpc.deb
      Size/MD5:  2083454 eae46dabf659bd8656d0fbaf6e8ceaa8
    http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-dev_2.1.16-6ubuntu0.1_powerpc.deb
      Size/MD5:   265412 db269fd664c7f9097caf62bd6147bece
    http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-imapd_2.1.16-6ubuntu0.1_powerpc.deb
      Size/MD5:   593496 6f797c3db11dede0486cef5bc210e9d9
    http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-murder_2.1.16-6ubuntu0.1_powerpc.deb
      Size/MD5:   527656 b8b38d4c59f7fa38b6175e16118d17eb
    http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-pop3d_2.1.16-6ubuntu0.1_powerpc.deb
      Size/MD5:    93268 c5094222880135acc57e10d74ad93c35
    http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/libcyrus-imap-perl21_2.1.16-6ubuntu0.1_powerpc.deb
      Size/MD5:   135690 e740ecc270bb11cdae18104c2f82738c

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20041123/738ba4dc/attachment.bin

Powered by blists - more mailing lists