Subject: Always check for buffer overflow

From: Chris Newman <[email-masked]>
Date: Tue, 21 Jul 1998 12:14:46 -0700 (PDT)

Having a security plug-in architecture does allow us to upgrade to better
security systems more easily.  But when you're busy writing code don't
forget to check for buffer overflows or it's all worthless.

There have been numerous problems with PAM implementations having security
holes.  I don't want to see SASL get bad press due to more implementation
mistakes.  It's hard enough to make security palatable to the general
public without having to overcome bad press. 

Now might be a good time to double-check your source for potential buffer
overflows. 

		- Chris

---
I. Description

The CERT Coordination Center has received reports regarding a buffer
overflow in some implementations of IMAP servers. The overflow is in library
code from the University of Washington IMAP server that handles SASL
server-level authentication. This vulnerability is different from the one
discussed in CERT Advisory CA-97.09.imap_pop. Information about this
vulnerability has been posted to various public mailing lists and
newsgroups.

All versions of the University of Washington IMAP server prior to the final
(frozen, non-beta) version of imap-4.1 that support SASL server-level
authentication are vulnerable. The vulnerability affects all University of
Washington IMAP4rev1 servers prior to v10.234. Also, any v10.234 server that
was distributed with Pine 4.0 or any imap-4.1.BETA is vulnerable.

Additionally, the vulnerability is present in other IMAP servers that use
library code from the University of Washington IMAP server to handle SASL
server-level authentication.

IMAP servers that share no code with the University of Washington server are
not vulnerable.

Some operating systems ship with a vulnerable version of this software
installed and enabled by default. Please refer to the Vendor Information
section below for more information about your vendor.