Bug 1000215 (CVE-2013-4279)

Kurt Seifried (kseifried) reports:

Title: imapsync default version check with http://imapsync.lamiral.info information leakage (CVE-2013-4278)

Threat: Availability: no timeout so an attacker simply sends a slow response
Threat: Confidentiality: connects to http://imapsync.lamiral.info and sends version # and operating system name and person version

Impact: Moderate (Medium)
CVSS2: 5.8/AV:N/AC:M/Au:N/C:P/I:N/A:P

Affected: imapsync version 1.564 and earlier on all supported platforms

Description: By default imapsync runs a "release check" when executed, this causes imapsync to connect to http://imapsync.lamiral.info and send information about the version of imapsync, the operating system and perl.

This feature is not well documented. It is enabled by default. The only hint it exists is the "--noreleasecheck" which is not documented anywhere other then running the program with the help option. 

Affected code:

sub imapsync_version_public {
    my $local_version = imapsync_version();
    my $imapsync_basename = imapsync_basename();
    my $agent_info = "$OSNAME system, perl "
       . sprintf("%vd", $PERL_VERSION)
        . ", Mail::IMAPClient $Mail::IMAPClient::VERSION"
        . " $imapsync_basename";
    my $sock = IO::Socket::INET->new(
        PeerAddr => 'imapsync.lamiral.info',
        PeerPort => '80',
		 Proto => 'tcp'
        ) ;
	return( 'unknown' ) if not $sock ;
    print $sock
        "GET /prj/imapsync/VERSION HTTP/1.0\n",
        "User-Agent: imapsync/$local_version ($agent_info)\n",
        "Host: ks.lamiral.info\n\n";
    my @line = <$sock>;
    close($sock);
    my $last_release = $line[-1];
    chomp($last_release);
    return($last_release);
}

Suggested solution:

1) $releasecheck should be changed to default to 0 (False) and convert --noreleasecheck to --releasecheck
2) this feature should use HTTPS to prevent information leakage to attackers
3) or disable this feature entirely