[10160] in bugtraq
Re: ipop3d (x2) / pine (x2) / Linux kernel (x2) / Midnight
daemon@ATHENA.MIT.EDU (Mark Crispin)
Fri Apr 9 18:32:18 1999
Date: Fri, 9 Apr 1999 09:18:15 -0700
Reply-To: Mark Crispin <MRC@CAC.WASHINGTON.EDU>
From: Mark Crispin <MRC@CAC.WASHINGTON.EDU>
X-To: "M.C.Mar" <emsi@it.pl>
To: BUGTRAQ@NETSPACE.ORG
In-Reply-To: <Pine.GSO.4.03.9904091258540.28344-100000@dollar.it.com.pl>
ipop3d 3.3(20) and imapd 7.8(100) are both several years old. The security
problems in those versions were published years ago. Those bugs were also
fixed years ago. What is your point?
On Fri, 9 Apr 1999 13:09:01 +0200 (MET DST), M.C.Mar wrote:
> ALL ABOVE IS TRUE ONLY FOR PINE, NOT FOR PINE COMPOONENTS (as ipop3d or
> imap, which is also vulnerable to semilocal buffer overflow that allows
> any user to read /etc/shadow). I tryed to explit pine, ipop3d [POP3
> 3.3(20) w/IMAP2 client (Comments to MRC@CAC.Washington.EDU)] and imap
> [IMAP2bis Service 7.8(100)].
>
> 1) I could not execute any code using pine although gdb shows I
> overwrited stack ret and ip register points to what I want.
> 2) I could read /etc/shadow exploiting ipop3d.
> 3) I could read /etc/shadow exploiting imap.
