Security fix for SA17062:

"A vulnerability in UW-imapd can be exploited by malicious users to
 cause a DoS (Denial of Service) or compromise a vulnerable system.

 The vulnerability is caused due to a boundary error in the
 "mail_valid_net_parse_work()" function when copying the user supplied
 mailbox name to a stack buffer. This can be exploited to cause a
 stack-based buffer overflow via a specially crafted mailbox name that
 contains an single opening double-quote character, without the
 corresponding closing double-quote.

 Successful exploitation allows arbitrary code execution, but requires
 valid credentials on the IMAP server."

http://secunia.com/advisories/17062/
www.idefense.com/application/poi/display?id=313&type=vulnerabilities
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2933

Patch from 2004g.

4 files changed, 23 insertions, 4 deletions

diff --git a/mail/imap-uw/Makefile b/mail/imap-uw/Makefile
index 10fb9c65cb0..952abc28145 100644
--- a/mail/imap-uw/Makefile
+++ b/mail/imap-uw/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.101 2005/10/05 13:29:51 wiz Exp $
+# $NetBSD: Makefile,v 1.102 2005/10/05 15:49:44 salo Exp $
 #
 # ATTENTION:
 # The Kerberos support in this software is known to be problematic. If you
@@ -6,6 +6,7 @@
 # but not running Kerberos before committing the changes.
 
 DISTNAME=       imap-2004e
+PKGREVISION=	1
 PKGNAME=        ${DISTNAME:S/-/-uw-/}
 CATEGORIES=     mail
 MASTER_SITES=	ftp://ftp.cac.washington.edu/imap/
diff --git a/mail/imap-uw/buildlink3.mk b/mail/imap-uw/buildlink3.mk
index 42e6354f959..0b7e6e4ffa2 100644
--- a/mail/imap-uw/buildlink3.mk
+++ b/mail/imap-uw/buildlink3.mk
@@ -1,4 +1,4 @@
-# $NetBSD: buildlink3.mk,v 1.4 2004/10/03 00:12:53 tv Exp $
+# $NetBSD: buildlink3.mk,v 1.5 2005/10/05 15:49:44 salo Exp $
 
 BUILDLINK_DEPTH:=	${BUILDLINK_DEPTH}+
 IMAP_UW_BUILDLINK3_MK:=	${IMAP_UW_BUILDLINK3_MK}+
@@ -12,7 +12,7 @@ BUILDLINK_PACKAGES+=	imap-uw
 
 .if !empty(IMAP_UW_BUILDLINK3_MK:M+)
 BUILDLINK_DEPENDS.imap-uw+=	imap-uw>=2004
-BUILDLINK_RECOMMENDED.imap-uw+=	imap-uw>=2004anb2
+BUILDLINK_RECOMMENDED.imap-uw+=	imap-uw>=2004enb1
 BUILDLINK_PKGSRCDIR.imap-uw?=	../../mail/imap-uw
 #
 # Make "-limapuw" resolve into "-lc-client".
diff --git a/mail/imap-uw/distinfo b/mail/imap-uw/distinfo
index 4f91fa81d68..1837135a103 100644
--- a/mail/imap-uw/distinfo
+++ b/mail/imap-uw/distinfo
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.24 2005/08/12 19:47:17 tv Exp $
+$NetBSD: distinfo,v 1.25 2005/10/05 15:49:44 salo Exp $
 
 SHA1 (imap-2004e.tar.Z) = 3c5cf83489dd8ac4c2cfd43370fcec85db7bc372
 RMD160 (imap-2004e.tar.Z) = 76c8596fe1a9a830bbd60fdafafb13f9bac42cd9
@@ -14,3 +14,4 @@ SHA1 (patch-aj) = 0a728d3b5271c048275a4d41002877e86ac275b2
 SHA1 (patch-ak) = c798b2aad17091526c667a552839cfe1ec0e23c9
 SHA1 (patch-al) = b746d36cb324114468d07d1aba7d22c5bd5b23b2
 SHA1 (patch-am) = 891de03bbc24de9eaf70d74c69b5b66d0b6b94b4
+SHA1 (patch-an) = f3c9e23406b5f6ae32ce51a81b1f2aab46d8394d
diff --git a/mail/imap-uw/patches/patch-an b/mail/imap-uw/patches/patch-an
new file mode 100644
index 00000000000..81348d14a7b
--- /dev/null
+++ b/mail/imap-uw/patches/patch-an
@@ -0,0 +1,17 @@
+$NetBSD: patch-an,v 1.1 2005/10/05 15:49:44 salo Exp $
+
+Security fix for CAN-2005-2933, from 2004g.
+
+--- src/c-client/mail.c.orig	2005-03-17 01:12:17.000000000 +0100
++++ src/c-client/mail.c	2005-10-05 17:37:13.000000000 +0200
+@@ -691,8 +691,10 @@
+       if (c == '=') {		/* parse switches which take arguments */
+ 	if (*t == '"') {	/* quoted string? */
+ 	  for (v = arg,i = 0,++t; (c = *t++) != '"';) {
++            if (!c) return NIL; /* unterminated string */
+ 				/* quote next character */
+ 	    if (c == '\\') c = *t++;
++            if (!c) return NIL; /* can't quote NUL either */
+ 	    arg[i++] = c;
+ 	  }
+ 	  c = *t++;		/* remember delimiter for later */