[14586] in bugtraq
pop3d/imap DOS (while we're on the subject)
daemon@ATHENA.MIT.EDU (Alex Mottram)
Thu Apr 20 11:55:28 2000
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-Id: <38FE552C.A6D2DE7D@net-connect.net>
Date: Wed, 19 Apr 2000 19:54:04 -0500
Reply-To: Alex Mottram <alex@NET-CONNECT.NET>
From: Alex Mottram <alex@NET-CONNECT.NET>
X-To: bugtraq@securityfocus.com
To: BUGTRAQ@SECURITYFOCUS.COM
I noticed the following behavior in the pop3 server as shipped with
Redhat 6.1 (still don't see
any updates to the imap package so I'm guessing it's still busted).
Unfortunately, I never got
off my butt and investigated it further or told anybody (until now).
Fortunately, it's not very
severe...
Basically, the pop server uses the same temp filename for each user in
the /tmp directory.
So.. if the file already exitsts, it assumes their mailbox is locked..
especially if it's owned by
a different user.
example:
[alex@alf alex]$ rpm -q imap
imap-4.5-4
(as a different user. I think if the user owns it, it'll remove it.
don't remember)
[zane@alf /tmp]$ :>.302.290fe
+OK POP3 localhost v7.59 server ready
user alex
+OK User name accepted, password please
pass xxxxxxxx
-ERR Can't get lock. Mailbox in use
...
