Executive brief
The University of Washington IMAP server, used for managing email on a server, contains a flaw in how it handles internal errors. An attacker with a valid user account can send specific commands that cause the server to crash and generate a diagnostic 'core dump' file in the user's directory. This file may contain highly sensitive information, including the system's password and shadow files, potentially allowing the attacker to gain full administrative control of the server.
Technical details
The imapd server in the University of Washington IMAP 4.1 toolkit fails to catch or ignore the SIGABRT signal when the fatal() function is called. Because IMAP allows users to maintain folders in writable directories on the server, the resulting abort() call generates a core dump file in a location accessible to the user. This core dump often contains the contents of /etc/passwd and /etc/shadow that were resident in memory. An attacker with existing credentials can trigger this via specific command sequences (e.g., CREATE/SELECT/COPY operations) to extract system-wide credentials. A recommended mitigation is to disable core dumps for the service using 'ulimit -c 0'.
Affected products
- University of Washington IMAP Toolkit 4.1 BETA
Timeline
- 1997-10-08: disclosed: L0pht Security Advisory released by Mudge
- 1997-10-08: advisory: NVD published date