LinuxSA Mailing list archives

  From: Dan Shearer <dan@linuxcare.com>
  To  : LinuxSA@linuxsa.org.au
  Date: Mon, 17 Apr 2000 16:25:42 +0930 (CST)

Re: Buffer overflows in IMAPD in RH latest ...

Ricahrd Sharpe said:

> >Original-recipient: rfc822;sharpe@NS.AUS.COM
> >
> >Newest RH:
> >
> >* OK nimue IMAP4rev1 v12.264 server ready
> >1 login lcamtuf test
> >1 OK LOGIN completed
> >1 list "" AAAAAAAAAAAAAAAAAAAAAAAAAAA...[yes, a lot of 'A's ;] 
> >Program received signal SIGSEGV, Segmentation fault.
> >0x41414141 in ?? ()

Quick overview of imap daemons:

That would be the UW imapd, which has a history of such problems.  Cyrus
imapd (http://asg.web.cmu.edu/cyrus) seems to be a bit more careful. These
programs are not substitutes for one another. Cyrus is much harder to set
up but does an awful lot more. If you happen to be in-between, ie you need
secure IMAP services with good performance but have managed with UW so
far, then consider changing to Cyrus for many reasons including a better
security history.

This is not to say that Cyrus won't have an identical problem tomorrow, of
course. People might claim that UW imapd gets hammered harder because it
is used more <shrug>. I like Cyrus' internal design better though.

--
Dan Shearer
dan@linuxcare.com
p: 08 8369 0303
m: 0411 49 1800
http://linuxcare.com
Linuxcare. Support for the Revolution.

-- 
LinuxSA WWW: http://www.linuxsa.org.au/  IRC: #linuxsa on irc.linux.org.au
To unsubscribe from the LinuxSA list:
  mail linuxsa-request@linuxsa.org.au with "unsubscribe" as the subject