Kurt Seifried (kseifried) reports: Title: imapsync default version check with http://imapsync.lamiral.info information leakage (CVE-2013-4278) Threat: Availability: no timeout so an attacker simply sends a slow response Threat: Confidentiality: connects to http://imapsync.lamiral.info and sends version # and operating system name and person version Impact: Moderate (Medium) CVSS2: 5.8/AV:N/AC:M/Au:N/C:P/I:N/A:P Affected: imapsync version 1.564 and earlier on all supported platforms Description: By default imapsync runs a "release check" when executed, this causes imapsync to connect to http://imapsync.lamiral.info and send information about the version of imapsync, the operating system and perl. This feature is not well documented. It is enabled by default. The only hint it exists is the "--noreleasecheck" which is not documented anywhere other then running the program with the help option. Affected code: sub imapsync_version_public { my $local_version = imapsync_version(); my $imapsync_basename = imapsync_basename(); my $agent_info = "$OSNAME system, perl " . sprintf("%vd", $PERL_VERSION) . ", Mail::IMAPClient $Mail::IMAPClient::VERSION" . " $imapsync_basename"; my $sock = IO::Socket::INET->new( PeerAddr => 'imapsync.lamiral.info', PeerPort => '80', Proto => 'tcp' ) ; return( 'unknown' ) if not $sock ; print $sock "GET /prj/imapsync/VERSION HTTP/1.0\n", "User-Agent: imapsync/$local_version ($agent_info)\n", "Host: ks.lamiral.info\n\n"; my @line = <$sock>; close($sock); my $last_release = $line[-1]; chomp($last_release); return($last_release); } Suggested solution: 1) $releasecheck should be changed to default to 0 (False) and convert --noreleasecheck to --releasecheck 2) this feature should use HTTPS to prevent information leakage to attackers 3) or disable this feature entirely
Created imapsync tracking bugs for this issue: Affects: fedora-all [bug 1054619]
Created imapsync tracking bugs for this issue: Affects: epel-all [bug 1054620]
imapsync-1.584-2.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.
imapsync-1.584-2.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.
imapsync-1.584-2.el5 has been pushed to the Fedora EPEL 5 stable repository. If problems still persist, please make note of it in this bug report.
I have pushed a patch to the Fedora and EPEL packages which disable the releasecheck