Bug 470820 (CVE-2008-5006) - CVE-2008-5006 uw-imap: NULL pointer dereference in smtp.c
Summary: CVE-2008-5006 uw-imap: NULL pointer dereference in smtp.c
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2008-5006
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL: http://nvd.nist.gov/nvd.cfm?cvename=C...
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2008-11-10 14:09 UTC by Tomas Hoger
Modified: 2021-11-12 19:53 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2009-01-30 14:49:34 UTC
Embargoed:


Attachments (Terms of Use)

Description Tomas Hoger 2008-11-10 14:09:13 UTC
Common Vulnerabilities and Exposures assigned an identifier CVE-2008-5006 to the following vulnerability:

smtp.c in the c-client library in University of Washington IMAP
Toolkit 2007b allows remote SMTP servers to cause a denial of service
(NULL pointer dereference and application crash) by responding to the
QUIT command with a close of the TCP connection instead of the
expected 221 response code.

References:
http://www.openwall.com/lists/oss-security/2008/11/03/5

Comment 1 Josh Bressers 2008-11-25 20:07:19 UTC
This source is also contained in pine (which we ship in RHEL2.1).  It's unlikely that pine would ever be connecting to a malicious SMTP server.

Comment 2 Tomas Hoger 2009-01-30 14:49:34 UTC
The affected code is not used by any application shipped in Red Hat Enterprise Linux 2.1, 3, 4, and 5.  The impact of this flaw is limited to a crash of the applications connecting to a misbehaving SMTP server.  Due to those reasons, there's currently no plan to include the fix in the imap packages as shipped in Red Hat Enterprise Linux 2.1 and 3, and the libc-client packages as shipped in Red Hat Enterprise Linux 4 and 5.

Version of uw-imap client packages as shipped in Fedora are already updated to upstream version 2007e, containing a fix for this issue.


Note You need to log in before you can comment on or make changes to this bug.