===================================================================== CERT-Renater Note d'Information No. 2005/VULN653 _____________________________________________________________________ DATE : 21/10/2005 HARDWARE PLATFORM(S) : / OPERATING SYSTEM(S) : Systems running imap. ====================================================================== _______________________________________________________________________ Mandriva Linux Security Update Advisory _______________________________________________________________________ Package name: imap Advisory ID: MDKSA-2005:189 Date: October 20th, 2005 Affected versions: 10.1, 10.2, 2006.0, Corporate 3.0, Corporate Server 2.1 ______________________________________________________________________ Problem Description: "infamous41md" discovered a buffer overflow in uw-imap, the University of Washington's IMAP Server that allows attackers to execute arbitrary code. The updated packages have been patched to address this issue. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2933 ______________________________________________________________________ Updated Packages: Mandrivalinux 10.1: 69c58eb0032175f0ad4c11b20bb0950d 10.1/RPMS/imap-2004-2.4.101mdk.i586.rpm 095bb4428a4dcfa8dbb1113faa816eb0 10.1/RPMS/imap-devel-2004-2.4.101mdk.i586.rpm be56925357c2bd87e8d3ab2320425f25 10.1/RPMS/imap-utils-2004-2.4.101mdk.i586.rpm fb97f03b7370293a13968f1a81d2a1fb 10.1/RPMS/libc-client-php0-2004-2.4.101mdk.i586.rpm 9d1bc41bc1a47badbf5dd85a608881cd 10.1/RPMS/libc-client-php0-devel-2004-2.4.101mdk.i586.rpm 41346e4e6d6cce99d39b17500797a68d 10.1/SRPMS/imap-2004-2.4.101mdk.src.rpm Mandrivalinux 10.1/X86_64: ac6fbd4efa4f48a488f05b988bf087dc x86_64/10.1/RPMS/imap-2004-2.4.101mdk.x86_64.rpm d34769399b742e2f7dde98dbd222233d x86_64/10.1/RPMS/imap-devel-2004-2.4.101mdk.x86_64.rpm 3cfab750045bb87546774f827ad2d614 x86_64/10.1/RPMS/imap-utils-2004-2.4.101mdk.x86_64.rpm 20035e5cc16d3ba793b2bd73d251edbc x86_64/10.1/RPMS/lib64c-client-php0-2004-2.4.101mdk.x86_64.rpm 72aecb118414fcb6f093b7100c286bfe x86_64/10.1/RPMS/lib64c-client-php0-devel-2004-2.4.101mdk.x86_64.rpm 41346e4e6d6cce99d39b17500797a68d x86_64/10.1/SRPMS/imap-2004-2.4.101mdk.src.rpm Mandrivalinux 10.2: e2bbba7c368d12901848c74b401bb137 10.2/RPMS/imap-2004c1-2.1.102mdk.i586.rpm 35929fa326ec9bcc5cc88298a1598c10 10.2/RPMS/imap-devel-2004c1-2.1.102mdk.i586.rpm 7e533b6735ec1cc2172fac57f8dc66ad 10.2/RPMS/imap-utils-2004c1-2.1.102mdk.i586.rpm a077b26ea62b1c733ecc29b4dd4b3d1d 10.2/RPMS/libc-client-php0-2004c1-2.1.102mdk.i586.rpm aa2e17250ba0aa46d0d31c6e68be2542 10.2/RPMS/libc-client-php0-devel-2004c1-2.1.102mdk.i586.rpm f21f37ae6b540d25c54c7b78f14bac65 10.2/SRPMS/imap-2004c1-2.1.102mdk.src.rpm Mandrivalinux 10.2/X86_64: a15b6435a6692b8421e35f6ecec1d900 x86_64/10.2/RPMS/imap-2004c1-2.1.102mdk.x86_64.rpm f727299b00c319b3bca63541860f5706 x86_64/10.2/RPMS/imap-devel-2004c1-2.1.102mdk.x86_64.rpm ec6da503c8d0885d6369c78ac2091020 x86_64/10.2/RPMS/imap-utils-2004c1-2.1.102mdk.x86_64.rpm 6e0f0045a593f1fd6acb0d7a91c30b65 x86_64/10.2/RPMS/lib64c-client-php0-2004c1-2.1.102mdk.x86_64.rpm e3ea4fb3c142f9977e1a172f7ea734dd x86_64/10.2/RPMS/lib64c-client-php0-devel-2004c1-2.1.102mdk.x86_64.rpm f21f37ae6b540d25c54c7b78f14bac65 x86_64/10.2/SRPMS/imap-2004c1-2.1.102mdk.src.rpm Mandrivalinux 2006.0: 8d27958f60639c90e128aa4af352d77b 2006.0/RPMS/imap-2004e-1.1.20060mdk.i586.rpm 71382080cb79121a313cfc36af369e82 2006.0/RPMS/imap-devel-2004e-1.1.20060mdk.i586.rpm 1069f3829b32ccd1328cb9abd35d92d2 2006.0/RPMS/imap-utils-2004e-1.1.20060mdk.i586.rpm 833a91be4ca845ffaf7bf326415b094b 2006.0/RPMS/libc-client-php0-2004e-1.1.20060mdk.i586.rpm be7e54ba29f3c4f749a96b3f95d10a10 2006.0/RPMS/libc-client-php0-devel-2004e-1.1.20060mdk.i586.rpm ecc0c763771e54e5b28294fe82590694 2006.0/SRPMS/imap-2004e-1.1.20060mdk.src.rpm Mandrivalinux 2006.0/X86_64: 5d4eef95276eedb0898b38dabb5cd5f4 x86_64/2006.0/RPMS/imap-2004e-1.1.20060mdk.x86_64.rpm 3d1a1a7afe408a401c7670f8428f204f x86_64/2006.0/RPMS/imap-devel-2004e-1.1.20060mdk.x86_64.rpm 784a5b9af498f9214a9c06f593562db2 x86_64/2006.0/RPMS/imap-utils-2004e-1.1.20060mdk.x86_64.rpm 9a6852a2402d3c15c4fe94438b10f3e9 x86_64/2006.0/RPMS/lib64c-client-php0-2004e-1.1.20060mdk.x86_64.rpm 4fe2e210cd842eb6752428a77defc0b8 x86_64/2006.0/RPMS/lib64c-client-php0-devel-2004e-1.1.20060mdk.x86_64.rpm ecc0c763771e54e5b28294fe82590694 x86_64/2006.0/SRPMS/imap-2004e-1.1.20060mdk.src.rpm Corporate Server 2.1: 2fdaf9b49c200b011ed209fcf34b1063 corporate/2.1/RPMS/imap-devel-2001a-9.2.C21mdk.i586.rpm 4dfb84ae980db92651c9be51653f246d corporate/2.1/RPMS/imap-2001a-9.2.C21mdk.i586.rpm 7c4b68b5e99db9a77765525c9e832270 corporate/2.1/SRPMS/imap-2001a-9.2.C21mdk.src.rpm Corporate Server 2.1/X86_64: 7fcef905c2f6f0e4c9415a5890880150 x86_64/corporate/2.1/RPMS/imap-2001a-9.2.C21mdk.x86_64.rpm 98f0fa3280d2f6d5de37c8b03f77dfbe x86_64/corporate/2.1/RPMS/imap-devel-2001a-9.2.C21mdk.x86_64.rpm 7c4b68b5e99db9a77765525c9e832270 x86_64/corporate/2.1/SRPMS/imap-2001a-9.2.C21mdk.src.rpm Corporate 3.0: eaef12eeac790a2880af5ecdc66f7d60 corporate/3.0/RPMS/imap-2002d-8.3.C30mdk.i586.rpm 1adc4061698d3f5835a6b3a10f09cd4d corporate/3.0/RPMS/imap-devel-2002d-8.3.C30mdk.i586.rpm d173305c62e79febec934d8b9195f021 corporate/3.0/RPMS/imap-utils-2002d-8.3.C30mdk.i586.rpm a41bf2dadb63dee7bc838314623d07ea corporate/3.0/SRPMS/imap-2002d-8.3.C30mdk.src.rpm Corporate 3.0/X86_64: 859bb7db71c8329fa11535935e857dea x86_64/corporate/3.0/RPMS/imap-2002d-8.3.C30mdk.x86_64.rpm c558f69d89804030f9526bc3e4bdd76e x86_64/corporate/3.0/RPMS/imap-devel-2002d-8.3.C30mdk.x86_64.rpm d693ca63de12e925105a9e3c2add1088 x86_64/corporate/3.0/RPMS/imap-utils-2002d-8.3.C30mdk.x86_64.rpm a41bf2dadb63dee7bc838314623d07ea x86_64/corporate/3.0/SRPMS/imap-2002d-8.3.C30mdk.src.rpm _______________________________________________________________________ To upgrade automatically use MandrakeUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team ====================================================================== ========================================================= Les serveurs de référence du CERT-Renater http://www.urec.fr/securite http://www.cru.fr/securite http://www.renater.fr ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 151 bd de l'Hopital | fax : 01-53-94-20-41 + + 75013 Paris | email: certsvp@renater.fr + =========================================================