libSieve IMAP Flag Buffer Overrun Vulnerability

Bugtraq ID:	6299
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 02 2002 12:00AM
Updated:	Dec 02 2002 12:00AM
Credit:	Discovery of this vulnerability is credited to Timo Sirainen <[email protected]>.
Vulnerable:	Cyrusoft libSieve 2.1.2 + Cmu Cyrus IMAP Server 2.1.10
Not Vulnerable:

libSieve IMAP Flag Buffer Overrun Vulnerability

A vulnerability has been discovered in the Sieve library. By passing a malicious IMAP flag of excessive length to a vulnerable program, it is possible to overrun a buffer and corrupt memory. By overwriting sensitive memory with attacker-supplied values, it may be possible to execute arbitrary instructions with privileges of the vulnerable process.

libSieve IMAP Flag Buffer Overrun Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

libSieve IMAP Flag Buffer Overrun Vulnerability

Solution:
An unofficial patch has been made available by Timo Sirainen <[email protected]> and can be obtained from the referenced advisory.

Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

libSieve IMAP Flag Buffer Overrun Vulnerability

References:

• Cyrus Sieve / libSieve buffer overflow (Timo Sirainen )