A vulnerability has been discovered in Courier-IMAP allowing for remote code execution with root privileges.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-mail/courier-imap | * | < 4.0.6-r2 | >= 4.0.6-r2, < 4.0.0 |
Courier-IMAP is an IMAP server which is part of the Courier mail system. It provides access only to maildirs.
CJ Kucera has discovered that some Courier-IMAP scripts don't properly handle the XMAILDIR variable, allowing for shell command injection.
A remote attacker could send specially crafted login credentials to a Courier-IMAP server instance, possibly leading to remote code execution with root privileges.
There is no known workaround at this time.
All Courier-IMAP users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-mail/courier-imap-4.0.6-r2"
There is a format string vulnerability in non-standard configurations of courier-imapd which may be exploited remotely. An attacker may be able to execute arbitrary code as the user running courier-imapd (oftentimes root).
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-mail/courier-imap | * | <= 3.0.2-r1 | >= 3.0.5 |
Courier-IMAP is an IMAP server which is part of the Courier mail system. It provides access only to maildirs.
There is a format string vulnerability in the auth_debug() function which can be exploited remotely, potentially leading to arbitrary code execution as the user running the IMAP daemon (oftentimes root). A remote attacker may send username or password information containing printf() format tokens (such as "%s"), which will crash the server or cause it to execute arbitrary code.
This vulnerability can only be exploited if DEBUG_LOGIN is set to something other than 0 in the imapd config file.
If DEBUG_LOGIN is enabled in the imapd configuration, a remote attacker may execute arbitrary code as the root user.
Set the DEBUG_LOGIN option in /etc/courier-imap/imapd to 0. (This is the default value.)
All courier-imap users should upgrade to the latest version:
# emerge sync # emerge -pv ">=net-mail/courier-imap-3.0.5" # emerge ">=net-mail/courier-imap-3.0.5"
Remote buffer overflow vulnerabilities have been found in Courier-IMAP and Courier MTA. These exploits may allow the execution of abritrary code, allowing unauthorized access to a vulnerable system.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| mail-mta/courier | * | < 0.45 | >= 0.45 |
| net-mail/courier-imap | * | < 3.0.0 | >= 3.0.0 |
Courier MTA is a multiprotocol mail server suite that provides webmail, mailing lists, IMAP, and POP3 services. Courier-IMAP is a standalone server that gives IMAP access to local mailboxes.
The vulnerabilities have been found in the 'SHIFT_JIS' converter in 'shiftjis.c' and 'ISO2022JP' converter in 'so2022jp.c'. An attacker may supply Unicode characters that exceed BMP (Basic Multilingual Plane) range, causing an overflow.
An attacker without privileges may exploit this vulnerability remotely, allowing arbitrary code to be executed in order to gain unauthorized access.
While a workaround is not currently known for this issue, all users are advised to upgrade to the latest version of the affected packages.
All users should upgrade to current versions of the affected packages:
# emerge sync # emerge -pv ">=net-mail/courier-imap-3.0.0" # emerge ">=net-mail/courier-imap-3.0.0" # ** Or; depending on your installation... ** # emerge -pv ">=mail-mta/courier-0.45" # emerge ">=mail-mta/courier-0.45"