Courier Japanese codeset converter buffer overflow
| courier-codeset-converter-bo (15434) |  Medium Risk |
Description:
Courier and Courier-IMAP are vulnerable to a buffer overflow in the shiftjis.c and iso2022jp.c converters, which are a part of the Courier Japanese codeset, caused by improper bounds checking of emails containing non-BMP (Basic Multilingual Plane) Unicode characters. A remote attacker could use this vulnerability to overflow a buffer and cause a denial of service.
Note: SqWebMail is also affected by this vulnerability.
Consequences:
Denial of Service
Remedy:
For Courier:
Upgrade to the latest version of Courier (0.45.1 or later), available from the Courier Mail Server Web page. See References.
For Courier-IMAP:
Upgrade to the latest version of Courier-IMAP (3.0.1 or later), available from the Courier Mail Server Web page. See References.
For SqWebMail:
Upgrade to the latest version of SqWebMail (4.0.1 or later), available from the Courier Mail Server Web page. See References.
For Gentoo Linux:
Upgrade to the latest version of courier (3.0.0 or later), as listed in GLSA 200403-06. See References.
For other distributions:
Contact your vendor for upgrade or patch information.
References:
- Courier Mail Server Release Notes Web page: Courier Mail Server: File Release Notes and Changelog.
- Courier Mail Server Web page: Courier Mail Server.
- GLSA 200403-06: Multiple remote buffer overflow vulnerabilities in Courier. (From LinuxSecurity archive)
- SqWebMail Web page: SqWebMail.
- BID-9845: Courier Multiple Remote Buffer Overflow Vulnerabilities
- CVE-2004-0224: Multiple buffer overflows in (1) iso2022jp.c or (2) shiftjis.c for Courier-IMAP before 3.0.0, Courier before 0.45, and SqWebMail before 4.0.0 may allow remote attackers to execute arbitrary code when Unicode character is out of BMP range.
- GLSA-200403-06: Multiple remote buffer overflow vulnerabilities in Courier
- SA11087: Courier Japanese Codeset Conversion Buffer Overflow Vulnerabilities
Platforms Affected:
- Courier-MTA Courier-IMAP prior to 3.0.0
- Double Precision Courier prior to 0.45
- Gentoo Linux
- Inter7 SqWebMail prior to 4.0.0
Reported:
Mar 11, 2004
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net