Cyrus IMAPD Pre-Login堆破坏漏洞

漏洞信息详情

Cyrus IMAPD Pre-Login堆破坏漏洞

• CNNVD编号：CNNVD-200406-049
• 危害等级： 高危
  
  
• CVE编号：
  CVE-2002-1580
  
• 漏洞类型：
  
  
  边界条件错误
  
• 发布时间：
  
  2002-12-03
  
• 威胁类型：
  
  
  远程
  
• 更新时间：
  
  2005-10-31
  
• 厂        商：
  
  carnegie_mellon_university
• 漏洞来源：
  Timo Sirainen※ tss…

Cyrus IMAPD是一款免费开放源代码IMAP协议实现，可使用在Unix和Linux操作系统下。
Cyrus IMAPD不充分处理登录超长字符串，远程攻击者可以利用这个漏洞对守护程序进行缓冲区溢出攻击，可能以IMAPD进程权限在系统上执行任意指令。
攻击者连接IMAPD守护程序，在连接协商阶段发送超长登录字符串，可导致发生基于堆的缓冲区溢出，精心构建提交的字符串可以覆盖内存任意地址而以IMAPD进程权限在系统上执行任意指令。

临时解决方法：
如果您不能立刻安装补丁或者升级，CNNVD建议您采取以下措施以降低威胁：

* Timo Sirainen <tss@iki.fi>提供了如下第三方补丁：

diff -ru cyrus-imapd-2.1.10-old/imap/imapparse.c cyrus-imapd-2.1.10/imap/imapparse.c

— cyrus-imapd-2.1.10-old/imap/imapparse.c 2002-06-24 21:58:41.000000000 +0300

+++ cyrus-imapd-2.1.10/imap/imapparse.c 2002-11-29 00:20:44.000000000 +0200

@@ -97,7 +97,7 @@

struct buf *buf, int type)

{

int c;

– int i;

+ unsigned int i;

unsigned int len = 0;

int sawdigit = 0;

int isnowait;

@@ -228,6 +228,16 @@

if (c != EOF) prot_ungetc(c, pin);

return EOF;

}

+ if (len > 65536) {

+ if (isnowait) {

+ for (i = 0; i < len; i++)

+ c = prot_getc(pin);

+ }

+ prot_printf(pout, “* BAD Literal too large\r\n”);

+ prot_flush(pout);

+ if (c != EOF) prot_ungetc(c, pin);

+ return EOF;

+ }

if (len >= buf->alloc) {

buf->alloc = len+1;

buf->s = xrealloc(buf->s, buf->alloc+1);
厂商补丁：
Debian
——
Debian已经为此发布了一个安全公告(DSA-215-1)以及相应补丁:

DSA-215-1：New cyrus-imapd packages fix remote command execution

链接：http://www.debian.org/security/2002/dsa-215” target=”_blank”>
http://www.debian.org/security/2002/dsa-215

补丁下载：

Source archives:

http://security.debian.org/pool/updates/non-free/c/cyrus-imapd/cyrus-imapd_1.5.19-2.2.dsc” target=”_blank”>
http://security.debian.org/pool/updates/non-free/c/cyrus-imapd/cyrus-imapd_1.5.19-2.2.dsc

Size/MD5 checksum: 681 7ed2dc53009118f622c466c7490910eb

http://security.debian.org/pool/updates/non-free/c/cyrus-imapd/cyrus-imapd_1.5.19-2.2.diff.gz” target=”_blank”>
http://security.debian.org/pool/updates/non-free/c/cyrus-imapd/cyrus-imapd_1.5.19-2.2.diff.gz

Size/MD5 checksum: 15807 75de24bbbf6906b2dcbc58ff94480faa

http://security.debian.org/pool/updates/non-free/c/cyrus-imapd/cyrus-imapd_1.5.19.orig.tar.gz” target=”_blank”>
http://security.debian.org/pool/updates/non-free/c/cyrus-imapd/cyrus-imapd_1.5.19.orig.tar.gz

Size/MD5 checksum: 526190 b789ea3868be439c27b24a8aa6d0b99f

Alpha architecture:

http://security.debian.org/pool/updates/non-free/c/cyrus-imapd/cyrus-admin_1.5.19-2.2_alpha.deb” target=”_blank”>
http://security.debian.org/pool/updates/non-free/c/cyrus-imapd/cyrus-admin_1.5.19-2.2_alpha.deb

Size/MD5 checksum: 42610 042e48cefd32648ad22780b2dd75d3e4

http://security.debian.org/pool/updates/non-free/c/cyrus-imapd/cyrus-common_1.5.19-2.2_alpha.deb” target=”_blank”>
http://security.debian.org/pool/updates/non-free/c/cyrus-imapd/cyrus-common_1.5.19-2.2_alpha.deb

Size/MD5 checksum: 570800 37eba3e8c00ceee87637527fda215e90

http://security.debian.org/pool/updates/non-free/c/cyrus-imapd/cyrus-dev_1.5.19-2.2_alpha.deb” target=”_blank”>
http://security.debian.org/pool/updates/non-free/c/cyrus-imapd/cyrus-dev_1.5.19-2.2_alpha.deb

Size/MD5 checksum: 83332 2d5105eebbace38839fe45897898560d

http://security.debian.org/pool/updates/non-free/c/cyrus-imapd/cyrus-imapd_1.5.19-2.2_alpha.deb” target=”_blank”>
http://security.debian.org/pool/updates/non-free/c/cyrus-imapd/cyrus-imapd_1.5.19-2.2_alpha.deb

Size/MD5 checksum: 165502 58d468b7568031ef6ebfb6d162a87ea2

http://security.debian.org/pool/updates/non-free/c/cyrus-imapd/cyrus-nntp_1.5.19-2.2_alpha.deb” target=”_blank”>
http://security.debian.org/pool/updates/non-free/c/cyrus-imapd/cyrus-nntp_1.5.19-2.2_alpha.deb

Size/MD5 checksum: 165366 a99934002ff65416f62949b48e161c2d

http://security.debian.org/pool/updates/non-free/c/cyrus-imapd/cyrus-pop3d_1.5.19-2.2_alpha.deb” target=”_blank”>
http://security.debian.org/pool/updates/non-free/c/cyrus-imapd/cyrus-pop3d_1.5.19-2.2_alpha.deb

Size/MD5 checksum: 78606 5616b0c2232bf237cd62aa79c60a74f6

ARM architecture:

http://security.debian.org/pool/updates/non-free/c/cyrus-imapd/cyrus-admin_1.5.19-2.2_arm.deb” target=”_blank”>
http://security.debian.org/pool/updates/non-free/c/cyrus-imapd/cyrus-admin_1.5.19-2.2_arm.deb

Size/MD5 checksum: 38378 68c99d95c4bc94244aa11531643e752a

http://security.debian.org/pool/updates/non-free/c/cyrus-imapd/cyrus-common_1.5.19-2.2_arm.deb” target=”_blank”>
http://security.debian.org/pool/updates/non-free/c/cyrus-imapd/cyrus-common_1.5.19-2.2_arm.deb

Size/MD5 checksum: 427770 29731f1cd6ee7a1bc18fd43d21a30d99

http://security.debian.org/pool/updates/non-free/c/cyrus-imapd/cyrus-dev_1.5.19-2.2_arm.deb” target=”_blank”>
http://security.debian.org/pool/updates/non-free/c/cyrus-imapd/cyrus-dev_1.5.19-2.2_arm.deb

Size/MD5 checksum: 77060 c3ef8e84ea192e1792811c889b7e64f6

http://security.debian.org/pool/updates/non-free/c/cyrus-imapd/cyrus-imapd_1.5.19-2.2_arm.deb” target=”_blank”>
http://security.debian.org/pool/updates/non-free/c/cyrus-imapd/cyrus-imapd_1.5.19-2.2_arm.deb

Size/MD5 checksum: 130436 f4424382f2945d196ce68d9dfe51ce04

http://security.debian.org/pool/updates/non-free/c/cyrus-imapd/cyrus-nntp_1.5.19-2.2_arm.deb” target=”_blank”>
http://security.debian.org/pool/updates/non-free/c/cyrus-imapd/cyrus-nntp_1.5.19-2.2_arm.deb

Size/MD5 checksum: 126334 290490d751199efae7feb518fe5e209a

http://security.debian.org/pool/updates/non-free/c/cyrus-imapd/cyrus-pop3d_1.5.19-2.2_arm.deb” target=”_blank”>
http://security.debian.org/pool/updates/non-free/c/cyrus-imapd/cyrus-pop3d_1.5.19-2.2_arm.deb

Size/MD5 checksum: 59246 55abe9bb680c1bf75a1d8ccda8d5c0ef

Intel IA-32 architecture:

http://security.debian.org/pool/updates/non-free/c/cyrus-imapd/cyrus-admin_1.5.19-2.2_i386.deb” target=”_blank”>
http://security.debian.org/pool/updates/non-free/c/cyrus-imapd/cyrus-admin_1.5.19-2.2_i386.deb

Size/MD5 checksum: 37840 c86d3b23d50017c4caefebaffaa52c88

http://security.debian.org/pool/updates/non-free/c/cyrus-imapd/cyrus-common_1.5.19-2.2_i386.deb” target=”_blank”>
http://security.debian.org/pool/updates/non-free/c/cyrus-imapd/cyrus-common_1.5.19-2.2_i386.deb

Size/MD5 checksum: 409216 e03b8b803fdd52b16f0da981a32d7cbd

http://security.debian.org/pool/updates/non-free/c/cyrus-imapd/cyrus-dev_1.5.19-2.2_i386.deb” target=”_blank”>
http://security.debian.org/pool/updates/non-free/c/cyrus-imapd/cyrus-dev_1.5.19-2.2_i386.deb

Size/MD5 checksum: 72742 7b41f08a21aab4683c60e0ff0c87f4ad

http://security.debian.org/pool/updates/non-free/c/cyrus-imapd/cyrus-imapd_1.5.19-2.2_i386.deb” target=”_blank”>
http://security.debian.org/pool/updates/non-free/c/cyrus-imapd/cyrus-imapd_1.5.19-2.2_i386.deb

Size/MD5 checksum: 121794 a1afc55e62e68546e1f746bebf215010

http://security.debian.org/pool/updates/non-free/c/cyrus-imapd/cyrus-nntp_1.5.19-2.2_i386.deb” target=”_blank”>
http://security.debian.org/pool/updates/non-free/c/cyrus-imapd/cyrus-nntp_1.5.19-2.2_i386.deb

Size/MD5 checksum: 

来源:US-CERT Vulnerability Note: VU#740169
名称: VU#740169
链接:http://www.kb.cert.org/vuls/id/740169

来源: XF
名称: cyrus-imap-preauth-bo(10744)
链接:http://xforce.iss.net/xforce/xfdb/10744

来源: BID
名称: 6298
链接:http://www.securityfocus.com/bid/6298

来源: BUGTRAQ
名称: 20021202 pre-login buffer overflow in Cyrus IMAP server
链接:http://www.securityfocus.com/archive/1/301864

来源: DEBIAN
名称: DSA-215
链接:http://www.debian.org/security/2002/dsa-215

来源: CONECTIVA
名称: CLA-2002:557
链接:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000557

来源: asg.web.cmu.edu
链接:http://asg.web.cmu.edu/cyrus/download/imapd/changes.html

来源: CONECTIVA
名称: 000557
链接:http://distro.conectiva.com/atualizacoes/?id=a&anuncio=000557