From a803ccb3b0f0a2fec355713061d98688def7843e Mon Sep 17 00:00:00 2001 From: snj Date: Sat, 8 Oct 2005 06:18:10 +0000 Subject: Pullup ticket 805 - requested by Lubomir Sedlacik security fix for imap-uw Revisions pulled up: - pkgsrc/mail/imap-uw/Makefile 1.102 - pkgsrc/mail/imap-uw/buildlink3.mk 1.5 - pkgsrc/mail/imap-uw/distinfo 1.25 - pkgsrc/mail/imap-uw/patches/patch-an 1.1 Module Name: pkgsrc Committed By: salo Date: Wed Oct 5 15:49:44 UTC 2005 Modified Files: pkgsrc/mail/imap-uw: Makefile buildlink3.mk distinfo Added Files: pkgsrc/mail/imap-uw/patches: patch-an Log Message: Security fix for SA17062: "A vulnerability in UW-imapd can be exploited by malicious users to cause a DoS (Denial of Service) or compromise a vulnerable system. The vulnerability is caused due to a boundary error in the "mail_valid_net_parse_work()" function when copying the user supplied mailbox name to a stack buffer. This can be exploited to cause a stack-based buffer overflow via a specially crafted mailbox name that contains an single opening double-quote character, without the corresponding closing double-quote. Successful exploitation allows arbitrary code execution, but requires valid credentials on the IMAP server." valid credentials on the IMAP server." http://secunia.com/advisories/17062/ www.idefense.com/application/poi/display?id=313&type=vulnerabilities http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2933 Patch from 2004g. --- mail/imap-uw/Makefile | 3 ++- mail/imap-uw/buildlink3.mk | 4 ++-- mail/imap-uw/distinfo | 3 ++- mail/imap-uw/patches/patch-an | 17 +++++++++++++++++ 4 files changed, 23 insertions(+), 4 deletions(-) create mode 100644 mail/imap-uw/patches/patch-an (limited to 'mail') diff --git a/mail/imap-uw/Makefile b/mail/imap-uw/Makefile index f6d73508950..91a12bf1137 100644 --- a/mail/imap-uw/Makefile +++ b/mail/imap-uw/Makefile @@ -1,4 +1,4 @@ -# $NetBSD: Makefile,v 1.98.2.1 2005/10/03 08:47:42 salo Exp $ +# $NetBSD: Makefile,v 1.98.2.2 2005/10/08 06:18:10 snj Exp $ # # ATTENTION: # The Kerberos support in this software is known to be problematic. If you @@ -6,6 +6,7 @@ # but not running Kerberos before committing the changes. DISTNAME= imap-2004e +PKGREVISION= 1 PKGNAME= ${DISTNAME:S/-/-uw-/} CATEGORIES= mail MASTER_SITES= ftp://ftp.cac.washington.edu/imap/ diff --git a/mail/imap-uw/buildlink3.mk b/mail/imap-uw/buildlink3.mk index 42e6354f959..224cafe2859 100644 --- a/mail/imap-uw/buildlink3.mk +++ b/mail/imap-uw/buildlink3.mk @@ -1,4 +1,4 @@ -# $NetBSD: buildlink3.mk,v 1.4 2004/10/03 00:12:53 tv Exp $ +# $NetBSD: buildlink3.mk,v 1.4.8.1 2005/10/08 06:18:10 snj Exp $ BUILDLINK_DEPTH:= ${BUILDLINK_DEPTH}+ IMAP_UW_BUILDLINK3_MK:= ${IMAP_UW_BUILDLINK3_MK}+ @@ -12,7 +12,7 @@ BUILDLINK_PACKAGES+= imap-uw .if !empty(IMAP_UW_BUILDLINK3_MK:M+) BUILDLINK_DEPENDS.imap-uw+= imap-uw>=2004 -BUILDLINK_RECOMMENDED.imap-uw+= imap-uw>=2004anb2 +BUILDLINK_RECOMMENDED.imap-uw+= imap-uw>=2004enb1 BUILDLINK_PKGSRCDIR.imap-uw?= ../../mail/imap-uw # # Make "-limapuw" resolve into "-lc-client". diff --git a/mail/imap-uw/distinfo b/mail/imap-uw/distinfo index 4f91fa81d68..4fb9503edc6 100644 --- a/mail/imap-uw/distinfo +++ b/mail/imap-uw/distinfo @@ -1,4 +1,4 @@ -$NetBSD: distinfo,v 1.24 2005/08/12 19:47:17 tv Exp $ +$NetBSD: distinfo,v 1.24.2.1 2005/10/08 06:18:10 snj Exp $ SHA1 (imap-2004e.tar.Z) = 3c5cf83489dd8ac4c2cfd43370fcec85db7bc372 RMD160 (imap-2004e.tar.Z) = 76c8596fe1a9a830bbd60fdafafb13f9bac42cd9 @@ -14,3 +14,4 @@ SHA1 (patch-aj) = 0a728d3b5271c048275a4d41002877e86ac275b2 SHA1 (patch-ak) = c798b2aad17091526c667a552839cfe1ec0e23c9 SHA1 (patch-al) = b746d36cb324114468d07d1aba7d22c5bd5b23b2 SHA1 (patch-am) = 891de03bbc24de9eaf70d74c69b5b66d0b6b94b4 +SHA1 (patch-an) = f3c9e23406b5f6ae32ce51a81b1f2aab46d8394d diff --git a/mail/imap-uw/patches/patch-an b/mail/imap-uw/patches/patch-an new file mode 100644 index 00000000000..0649e59b5fa --- /dev/null +++ b/mail/imap-uw/patches/patch-an @@ -0,0 +1,17 @@ +$NetBSD: patch-an,v 1.1.2.2 2005/10/08 06:18:10 snj Exp $ + +Security fix for CAN-2005-2933, from 2004g. + +--- src/c-client/mail.c.orig 2005-03-17 01:12:17.000000000 +0100 ++++ src/c-client/mail.c 2005-10-05 17:37:13.000000000 +0200 +@@ -691,8 +691,10 @@ + if (c == '=') { /* parse switches which take arguments */ + if (*t == '"') { /* quoted string? */ + for (v = arg,i = 0,++t; (c = *t++) != '"';) { ++ if (!c) return NIL; /* unterminated string */ + /* quote next character */ + if (c == '\\') c = *t++; ++ if (!c) return NIL; /* can't quote NUL either */ + arg[i++] = c; + } + c = *t++; /* remember delimiter for later */ -- cgit v1.2.3