cyrus-sasl pop3 buffer overflow

[Josh Bressers]

I ran across this:
http://marc.theaimsgroup.com/?l=full-disclosure&m=114821239014171&...

The popsubfolders option seems to have been added after 2.3, FC5 may be
affected.

I ran the exploit against a copy of FC5, I got this in the log file:

May 21 20:26:51 bowser pop3[5075]: buffer overflow while canonicalizing

If someone who knows cyrus-imapd a little better could take a look at this
it would be appreciated.  It's possible this is a 2.3.2 only issue (we ship
2.3.1 in FC5).

If nobody else gets to this, I'll try to take a better look tomorrow.

-- 
    JB

[Jason L Tibbitts III]

> >>>> "JB" == Josh Bressers
> <bressers(a)redhat.com&gt; writes: 
JB> The popsubfolders option seems to have been added after 2.3, FC5
JB> may be affected.

Yes, I think so.  The cyrus-imapd package is weird; CVS devel "branch"
has an older version, while the built rawhide tree has the ".fc5"
tagged version.

Inspection of the code seems to indicate that 2.3.1 is indeed
vulnerable; the responsible code in imap/pop3d.c seems to be unchanged
between 2.3.1 and 2.3.2 (and 2.3.3, the latest version, so we'll have
to dig up a patch).

 - J<

[Jason L Tibbitts III]

BTW, nothing I can find on the cyrus mailing lists and nothing to be
found on https://bugzilla.andrew.cmu.edu/

 - J<