中文描述:

Cyrus IMAP Server是一款免费开放源代码Interactive Mail Access Protocol (IMAP)协议实现，可使用在Unix和Linux操作系统下。 Cyrus-imapd的pop3d中存在远程溢出漏洞。如果在imapd.conf中Cyrus-imapd将popsubfolders设置为1的话，则攻击者就可以通过向远程pop3d发送超长的USER命令参数触发栈溢出。 在cyrus-imapd-2.3.2/imap/pop3d.c中，每次向pop3 server提供USER命令时都会调用pop3d_canon_user，ulen=0。在char userbuf[MAX_MAILBOX_NAME+1], *p; ... if (!ulen) ulen = strlen(user); ... memcpy(userbuf, user, ulen); userbuf[ulen] = '\0'; 这个例程中没有执行长度检查，如果user大于MAX_MAILBOX_NAME+1的话，memcpy就会溢出userbuf缓冲区。 --- snip ---static int popd_canon_user(sasl_conn_t *conn, void *context, const char *user, unsigned ulen, unsigned flags, const char *user_realm, char *out, unsigned out_max, unsigned *out_ulen) { char userbuf[MAX_MAILBOX_NAME+1], *p; size_t n; int r; if (!ulen) ulen = strlen(user); if (config_getswitch(IMAPOPT_POPSUBFOLDERS)) { /* make a working copy of the auth[z]id */ memcpy(userbuf, user, ulen); userbuf[ulen] = '\0'; user = userbuf; /* See if we're trying to access a subfolder */ if ((p = strchr(userbuf, '+'))) { n = config_virtdomains ? strcspn(p, "@") : strlen(p); if (flags & SASL_CU_AUTHZID) { /* make a copy of the subfolder */ if (popd_subfolder) free(popd_subfolder); popd_subfolder = xstrndup(p, n); } /* strip the subfolder from the auth[z]id */ memmove(p, p+n, strlen(p+n)+1); ulen -= n; } } r = mysasl_canon_user(conn, context, user, ulen, flags, user_realm, out, out_max, out_ulen); if (!r & & popd_subfolder & & flags == SASL_CU_AUTHZID) { /* If we're only doing the authzid, put back the subfolder in case its used in the challenge/response calculation */ n = strlen(popd_subfolder); if (*out_ulen + n > out_max) { sasl_seterror(conn, 0, "buffer overflow while canonicalizing"); r = SASL_BUFOVER; } else { p = (config_virtdomains & & (p = strchr(out, '@'))) ? p : out + *out_ulen; memmove(p+n, p, strlen(p)+1); memcpy(p, popd_subfolder, n); *out_ulen += n; } } return r; } --- snip ---

英文描述:

Stack-based buffer overflow in pop3d in Cyrus IMAPD (cyrus-imapd) 2.3.2, when the popsubfolders option is enabled, allows remote attackers to execute arbitrary code via a long USER command.

CWE类型:

标签:

中文解决方案:

英文解决方案:

临时解决方案: