Date: Mon, 12 Mar 2001 12:21:18 -0700
From: Caldera Support Info <sup-info@locutus4.calderasystems.com>
To: announce@lists.calderasystems.com, bugtraq@securityfocus.com,
Subject: Security Update:  several buffer overflows in imap, ipop2d and ipop3d CSSA-2001-011.0


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

______________________________________________________________________________
		   Caldera Systems, Inc.  Security Advisory

Subject:		several buffer overflows in imap, ipop2d and ipop3d
Advisory number: 	CSSA-2001-011.0
Issue date: 		2001 March, 12
Cross reference:
______________________________________________________________________________


1. Problem Description

   There are several buffer overflows in imap, ipop2d and ipop3d. These 
   overflows usually only make it possible for local users to gain access
   to a process running under their own UID.

   However, due to a misconfiguration, it is possible for remote
   attackers to gain access to the 'nobody' account and run programs
   or further exploits on the attacked machine.

2. Vulnerable Versions

   System                       Package
   -----------------------------------------------------------
   OpenLinux 2.3		All packages previous to
   				imap-4.6.BETA-2

   OpenLinux eServer 2.3.1      All packages previous to
   and OpenLinux eBuilder  	imap-4.6.BETA-2

   OpenLinux eDesktop 2.4       All packages previous to
   				imap-4.7-2

3. Solution

   Workaround

     none

   The proper solution is to upgrade to the latest packages.

4. OpenLinux 2.3

   4.1 Location of Fixed Packages

       The upgrade packages can be found on Caldera's FTP site at:
        
       ftp://ftp.calderasystems.com/pub/updates/OpenLinux/2.3/current/RPMS/

       The corresponding source code package can be found at:

       ftp://ftp.calderasystems.com/pub/updates/OpenLinux/2.3/current/SRPMS

   4.2 Verification

       1734155c1a521454514832a38e5bb2c0  RPMS/imap-4.6.BETA-2.i386.rpm
       4fcad7966ca27f7a63ee912de6045811  SRPMS/imap-4.6.BETA-2.src.rpm

   4.3 Installing Fixed Packages

       Upgrade the affected packages with the following commands:

          rpm -Fhv imap*.i386.rpm

5. OpenLinux eServer 2.3.1 and OpenLinux eBuilder for ECential 3.0

   5.1 Location of Fixed Packages

       The upgrade packages can be found on Caldera's FTP site at:

       ftp://ftp.calderasystems.com/pub/updates/eServer/2.3/current/RPMS/

       The corresponding source code package can be found at:

       ftp://ftp.calderasystems.com/pub/updates/eServer/2.3/current/SRPMS

   5.2 Verification

       97f0da23b7f459d0da8fc9b2fb9fc00e  RPMS/imap-4.6.BETA-2.i386.rpm
       9d7d8b72db44cc1b9c53d3f4b2aba092  SRPMS/imap-4.6.BETA-2.src.rpm

   5.3 Installing Fixed Packages

       Upgrade the affected packages with the following commands:

          rpm -Fvh imap*i386.rpm

6. OpenLinux eDesktop 2.4

   6.1 Location of Fixed Packages

       The upgrade packages can be found on Caldera's FTP site at:

       ftp://ftp.calderasystems.com/pub/updates/eDesktop/2.4/current/RPMS/

       The corresponding source code package can be found at:

       ftp://ftp.calderasystems.com/pub/updates/eDesktop/2.4/current/SRPMS

   6.2 Verification

       0ac6767f30f6f5f20e556a34d5928911  RPMS/imap-4.7-2.i386.rpm
       639eaca8cb1c6ff4884fc36b711d792e  RPMS/imap-devel-4.7-2.i386.rpm
       2a056aae7f0bb2c434c5955dc5cb60bc  SRPMS/imap-4.7-2.src.rpm

   6.3 Installing Fixed Packages

       Upgrade the affected packages with the following commands:

       rpm -Fvh imap*i386.rpm

7. References

   This and other Caldera security resources are located at:

   http://www.calderasystems.com/support/security/index.html

   This security fix closes Caldera's internal Problem Report 9328.

8. Disclaimer

   Caldera Systems, Inc. is not responsible for the misuse of any of the
   information we provide on this website and/or through our security
   advisories. Our advisories are a service to our customers intended to
   promote secure installation and use of Caldera OpenLinux.

9. Acknowledgements

   Caldera Systems wishes to thank Chris Evans for spotting this
   problem and providing a fix.
______________________________________________________________________________
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.1 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE6rMXC18sy83A/qfwRAiV2AKDFi9u61d2hiKS/q3KBTwdvibMo7QCcDNsp
RoA1WFvnZHqEcS2CVQ6oFDE=
=EGDj
-----END PGP SIGNATURE-----