Bug 260115 (CVE-2009-0671)

Summary:	net-libs/c-client format string vulnerability (CVE-2009-0671)
Product:	Gentoo Security	Reporter:	Robert Buchholz (RETIRED) <rbu>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED INVALID
Severity:	normal	CC:	net-mail+disabled, wrobel
Priority:	High
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	http://packetstormsecurity.org/0902-exploits/uwimap-format.txt
Whiteboard:	B2 [ebuild]
Package list:		Runtime testing required:	---
Bug Depends on:
Bug Blocks:	255121, 260117

Description Robert Buchholz (RETIRED) gentoo-dev

2009-02-24 11:40:27 UTC

CVE-2009-0671 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-0671):
  Format string vulnerability in the University of Washington (UW)
  c-client library, as used by the UW IMAP toolkit imap-2007d and other
  applications, allows remote attackers to execute arbitrary code via
  format string specifiers in the initial request to the IMAP port
  (143/tcp).

Comment 1 Robert Buchholz (RETIRED) gentoo-dev

2009-02-24 11:43:36 UTC

Red Hat is disputing this issue, see https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-0671

Comment 2 Robert Buchholz (RETIRED) gentoo-dev

2009-02-25 16:09:11 UTC

The CVE will be REJECTED, both upstream and other researchers could not confirm this report.