|
|
多个厂商IMAP客户端Mailbox大小内存破坏漏洞
发布时间：2003-05-14
更新时间：2003-05-14
严重程度：高
威胁程度：远程拒绝服务
错误类型：边界检查错误
利用方式：服务器模式
BUGTRAQ ID：7602
受影响系统GNOME Balsa 2.0.6
+RedHat Linux 9.0 i386
GNOME Balsa 2.0.10
Mutt Mutt 1.2 -1
Mutt Mutt 1.2.5
+Caldera OpenLinux 2.3
+Caldera OpenLinux 3.1 -IA64
+Caldera OpenLinux eBuilder 3.0
+Caldera OpenLinux Server 3.1
+Caldera OpenLinux Server 3.1.1
+Caldera OpenLinux Workstation 3.1
+Caldera OpenLinux Workstation 3.1.1
+Conectiva Linux 6.0
+Debian Linux 2.2 68k
+Debian Linux 2.2 alpha
+Debian Linux 2.2 arm
+Debian Linux 2.2 IA-32
+Debian Linux 2.2 powerpc
+Debian Linux 2.2 sparc
+HP Secure OS software for Linux 1.0
+RedHat Linux 7.0 alpha
+RedHat Linux 7.0 i386
+RedHat Linux 7.0 sparc
+RedHat Linux 7.0 J i386
+RedHat Linux 7.1 alpha
+RedHat Linux 7.1 i386
+RedHat Linux 7.1 ia64
+RedHat Linux 7.2 i386
+RedHat Linux 7.2 ia64
+SCO eDesktop 2.4
+SCO eServer 2.3.1
+Trustix Secure Linux 1.2
+Trustix Secure Linux 1.5
Mutt Mutt 1.3.12
+S.u.S.E. Linux 7.1 alpha
+S.u.S.E. Linux 7.1 ppc
+S.u.S.E. Linux 7.1 sparc
+S.u.S.E. Linux 7.1 x86
Mutt Mutt 1.3.16
+S.u.S.E. Linux 7.2
+S.u.S.E. Linux 7.2 i386
Mutt Mutt 1.3.17
+Conectiva Linux 7.0
Mutt Mutt 1.3.22
+S.u.S.E. Linux 7.3
+S.u.S.E. Linux 7.3 i386
+S.u.S.E. Linux 7.3 ppc
+S.u.S.E. Linux 7.3 sparc
Mutt Mutt 1.3.24
Mutt Mutt 1.3.25
Mutt Mutt 1.3.27
+S.u.S.E. Linux 8.0
+S.u.S.E. Linux 8.0 i386
Mutt Mutt 1.3.28
+Debian Linux 3.0
+Debian Linux 3.0 alpha
+Debian Linux 3.0 arm
+Debian Linux 3.0 hppa
+Debian Linux 3.0 ia-32
+Debian Linux 3.0 ia-64
+Debian Linux 3.0 m68k
+Debian Linux 3.0 mips
+Debian Linux 3.0 mipsel
+Debian Linux 3.0 ppc
+Debian Linux 3.0 s/390
+Debian Linux 3.0 sparc
+MandrakeSoft Linux Mandrake 8.2
+MandrakeSoft Linux Mandrake 8.2 ppc
Mutt Mutt 1.4 .0
+MandrakeSoft Linux Mandrake 9.0
+MandrakeSoft Linux Mandrake 9.1
+MandrakeSoft Linux Mandrake 9.1 ppc
+OpenPKG OpenPKG Current
+OpenPKG OpenPKG 1.1
+OpenPKG OpenPKG 1.2
+RedHat Linux 8.0
+RedHat Linux 8.0 i386
+RedHat Linux 8.0 i686
+S.u.S.E. Linux 8.1
Mutt Mutt 1.4.1
University of Washington imap 2002b
University of Washington Pine 4.21
+Conectiva Linux ecommerce
+Conectiva Linux graficas
+Conectiva Linux 5.0
+Conectiva Linux 5.1
+Conectiva Linux 6.0
+Conectiva Linux 7.0
+RedHat Linux 6.2 alpha
+RedHat Linux 6.2 i386
+RedHat Linux 6.2 sparc
+RedHat Linux 7.0 alpha
+RedHat Linux 7.0 i386
+Slackware Linux 7.0
+Slackware Linux 7.1
University of Washington Pine 4.30
University of Washington Pine 4.33
-FreeBSD FreeBSD 4.2
-FreeBSD FreeBSD 4.3
-FreeBSD FreeBSD 4.4
+HP Secure OS software for Linux 1.0
+RedHat Linux 7.1 alpha
+RedHat Linux 7.1 i386
+RedHat Linux 7.1 ia64
+RedHat Linux 7.2 i386
+RedHat Linux 7.2 ia64
+S.u.S.E. Linux 7.1
+S.u.S.E. Linux 7.1 alpha
+S.u.S.E. Linux 7.1 ppc
+S.u.S.E. Linux 7.1 sparc
+S.u.S.E. Linux 7.2
+S.u.S.E. Linux 7.2 i386
+S.u.S.E. Linux 7.3
+S.u.S.E. Linux 7.3 i386
+S.u.S.E. Linux 7.3 ppc
+S.u.S.E. Linux 7.3 sparc
University of Washington Pine 4.44
+EnGarde Secure Linux 1.0.1
+S.u.S.E. Linux 8.0
+S.u.S.E. Linux 8.0 i386
+S.u.S.E. Linux 8.1
University of Washington Pine 4.52
University of Washington Pine 4.53 未影响系统University of Washington imap 2002c 详细描述
多种支持IMAP协议的邮件客户端存在内存破坏漏洞。
客户端在处理IMAP服务器指定mailbox大小的时候存在漏洞，恶意的IMAP服务器可以通过发送超大的值使得邮件客户端内存破坏，可能可以执行任意代码。
相关信息
Timo Sirainen <tss@iki.fi>
http://online.securityfocus.com/archive/1/321528
|
