Courier Multiple Remote Buffer Overflow Vulnerabilities

Bugtraq ID:	9845
Class:	Boundary Condition Error
CVE:	CVE-2004-0224
Remote:	Yes
Local:	No
Published:	Mar 11 2004 12:00AM
Updated:	Jul 12 2009 03:06AM
Credit:	These issues were disclosed by the vendor.
Vulnerable:	Inter7 Courier-IMAP 2.2.1 Inter7 Courier-IMAP 2.2 .0 Inter7 Courier-IMAP 2.1.2 Inter7 Courier-IMAP 2.1.1 Inter7 Courier-IMAP 2.1 Inter7 Courier-IMAP 2.0 .0 Inter7 Courier-IMAP 1.7 Inter7 Courier-IMAP 1.6 Gentoo Linux 1.4 _rc3 Gentoo Linux 1.4 _rc2 Gentoo Linux 1.4 _rc1 Gentoo Linux 1.4 Double Precision Incorporated SqWebMail 3.6.2 Double Precision Incorporated SqWebMail 3.6.1 Double Precision Incorporated SqWebMail 3.6 .0 Double Precision Incorporated SqWebMail 3.5.3 Double Precision Incorporated SqWebMail 3.5.2 Double Precision Incorporated Courier MTA 0.44.2 Double Precision Incorporated Courier MTA 0.44 Double Precision Incorporated Courier MTA 0.43.2 Double Precision Incorporated Courier MTA 0.43.1 Double Precision Incorporated Courier MTA 0.43 Double Precision Incorporated Courier MTA 0.42.2 Double Precision Incorporated Courier MTA 0.40.1 Double Precision Incorporated Courier MTA 0.40 Double Precision Incorporated Courier MTA 0.38.1 - FreeBSD FreeBSD 4.5 - FreeBSD FreeBSD 4.4 - FreeBSD FreeBSD 4.3 - FreeBSD FreeBSD 4.2 - IBM AIX 4.3.3 - IBM AIX 4.3.2 - IBM AIX 4.3.1 - IBM AIX 4.3 - IBM AIX 5.1 - Mandriva Linux Mandrake 8.2 - Mandriva Linux Mandrake 8.1 ia64 - Mandriva Linux Mandrake 8.1 - Mandriva Linux Mandrake 8.0 ppc - Mandriva Linux Mandrake 8.0 - Mandriva Linux Mandrake 7.2 - NetBSD NetBSD 1.5.2 - NetBSD NetBSD 1.5.1 - NetBSD NetBSD 1.5 - OpenBSD OpenBSD 2.9 - OpenBSD OpenBSD 2.8 - OpenBSD OpenBSD 2.7 - OpenBSD OpenBSD 2.6 - OpenBSD OpenBSD 3.1 - OpenBSD OpenBSD 3.0 - Redhat Linux 7.3 i386 - Redhat Linux 7.2 ia64 - Redhat Linux 7.2 i386 - Redhat Linux 7.1 ia64 - Redhat Linux 7.1 i386 - Redhat Linux 7.1 alpha - Redhat Linux 7.0 sparc - Redhat Linux 7.0 i386 - Redhat Linux 7.0 alpha - Sun Solaris 8_x86 - Sun Solaris 8_sparc - Sun Solaris 7.0_x86 - Sun Solaris 7.0 - Sun Solaris 2.6_x86 - Sun Solaris 2.6 - SuSE Linux 8.0 i386 - SuSE Linux 7.3 sparc - SuSE Linux 7.3 ppc - SuSE Linux 7.3 i386 - SuSE Linux 7.2 i386 - SuSE Linux 7.1 x86 - SuSE Linux 7.1 sparc - SuSE Linux 7.1 ppc - SuSE Linux 7.1 alpha - SuSE Linux 7.0 sparc - SuSE Linux 7.0 ppc - SuSE Linux 7.0 i386 - SuSE Linux 7.0 alpha Double Precision Incorporated Courier MTA 0.37.3 + Debian Linux 3.0 sparc + Debian Linux 3.0 s/390 + Debian Linux 3.0 ppc + Debian Linux 3.0 mipsel + Debian Linux 3.0 mips + Debian Linux 3.0 m68k + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 hppa + Debian Linux 3.0 arm + Debian Linux 3.0 alpha
Not Vulnerable:	Inter7 Courier-IMAP 3.0.1 Inter7 Courier-IMAP 3.0 .0 Double Precision Incorporated SqWebMail 4.0.1 Double Precision Incorporated SqWebMail 4.0 .0 Double Precision Incorporated Courier MTA 0.45.1 Double Precision Incorporated Courier MTA 0.45

Courier Multiple Remote Buffer Overflow Vulnerabilities

Multiple buffer overflow vulnerabilities have been identified in Courier MTA, Courier SqWebMail, and Courier-IMAP. These vulnerabilities may allow a remote attacker to execute arbitrary code on a vulnerable system in order to gain unauthorized access.

The issues exist in the 'SHIFT_JIS' converter in 'shiftjis.c' and 'ISO2022JP' converter in 'so2022jp.c'. An attacker may be able to exploit these issues by supplying Unicode characters that exceed BMP (Basic Multilingual Plane) range.

These issues have been reported to affect Courier MTA 0.44.2 and prior, Courier-IMAP 2.2.1 and prior, and Courier SqWebMail 3.6.2 and prior. It has also been reported that the vulnerable codeset mappings may be employed by the Courier IMAP and Webmail service, however, they are not enabled by default.

These issues are being further analyzed and this BID will be updated once analysis is complete.

Courier Multiple Remote Buffer Overflow Vulnerabilities

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Courier Multiple Remote Buffer Overflow Vulnerabilities

Solution:
The vendor has released Courier MTA 0.45, Courier-IMAP 3.0.0, and SqWebMail 4.0.0 to address these issues.

Gentoo have released an advisory (GLSA 200403-06) and updates to address this issue. Gentoo users are advised to upgrade to current packages by emerging the updated packages as follows:
# emerge sync

And depending on your installation:
# emerge -pv ">=net-mail/courier-imap-3.0.0"
# emerge ">=net-mail/courier-imap-3.0.0"

Or:
# emerge -pv ">=net-mail/courier-0.45"
# emerge ">=net-mail/courier-0.45"


Double Precision Incorporated Courier MTA 0.37.3

• Double Precision Incorporated courier-0.45.1.tar.bz2
  http://www.courier-mta.org/download.php

Double Precision Incorporated Courier MTA 0.38.1

• Double Precision Incorporated courier-0.45.1.tar.bz2
  http://www.courier-mta.org/download.php

Double Precision Incorporated Courier MTA 0.40

• Double Precision Incorporated courier-0.45.1.tar.bz2
  http://www.courier-mta.org/download.php

Double Precision Incorporated Courier MTA 0.40.1

• Double Precision Incorporated courier-0.45.1.tar.bz2
  http://www.courier-mta.org/download.php

Double Precision Incorporated Courier MTA 0.42.2

• Double Precision Incorporated courier-0.45.1.tar.bz2
  http://www.courier-mta.org/download.php

Double Precision Incorporated Courier MTA 0.43

• Double Precision Incorporated courier-0.45.1.tar.bz2
  http://www.courier-mta.org/download.php

Double Precision Incorporated Courier MTA 0.43.1

• Double Precision Incorporated courier-0.45.1.tar.bz2
  http://www.courier-mta.org/download.php

Double Precision Incorporated Courier MTA 0.43.2

• Double Precision Incorporated courier-0.45.1.tar.bz2
  http://www.courier-mta.org/download.php

Double Precision Incorporated Courier MTA 0.44

• Double Precision Incorporated courier-0.45.1.tar.bz2
  http://www.courier-mta.org/download.php

Double Precision Incorporated Courier MTA 0.44.2

• Double Precision Incorporated courier-0.45.1.tar.bz2
  http://www.courier-mta.org/download.php

Inter7 Courier-IMAP 1.6

• Inter7 courier-imap-3.0.1.tar.bz2
  http://www.courier-mta.org/download.php

Inter7 Courier-IMAP 1.7

• Inter7 courier-imap-3.0.1.tar.bz2
  http://www.courier-mta.org/download.php

Inter7 Courier-IMAP 2.0 .0

• Inter7 courier-imap-3.0.1.tar.bz2
  http://www.courier-mta.org/download.php

Inter7 Courier-IMAP 2.1

• Inter7 courier-imap-3.0.1.tar.bz2
  http://www.courier-mta.org/download.php

Inter7 Courier-IMAP 2.1.1

• Inter7 courier-imap-3.0.1.tar.bz2
  http://www.courier-mta.org/download.php

Inter7 Courier-IMAP 2.1.2

• Inter7 courier-imap-3.0.1.tar.bz2
  http://www.courier-mta.org/download.php

Inter7 Courier-IMAP 2.2 .0

• Inter7 courier-imap-3.0.1.tar.bz2
  http://www.courier-mta.org/download.php

Inter7 Courier-IMAP 2.2.1

• Inter7 courier-imap-3.0.1.tar.bz2
  http://www.courier-mta.org/download.php

Double Precision Incorporated SqWebMail 3.5.2

• Double Precision Incorporated sqwebmail-4.0.1.tar.bz2
  http://www.courier-mta.org/download.php

Double Precision Incorporated SqWebMail 3.5.3

• Double Precision Incorporated sqwebmail-4.0.1.tar.bz2
  http://www.courier-mta.org/download.php

Double Precision Incorporated SqWebMail 3.6 .0

• Double Precision Incorporated sqwebmail-4.0.1.tar.bz2
  http://www.courier-mta.org/download.php

Double Precision Incorporated SqWebMail 3.6.1

• Double Precision Incorporated sqwebmail-4.0.1.tar.bz2
  http://www.courier-mta.org/download.php

Double Precision Incorporated SqWebMail 3.6.2

• Double Precision Incorporated sqwebmail-4.0.1.tar.bz2
  http://www.courier-mta.org/download.php

Courier Multiple Remote Buffer Overflow Vulnerabilities

References:

• Courier Mail Server: Release Notes (Courier)
  
• Vendor Homepage (Courier)