Bug 794772 (CVE-2021-3578) – <net-mail/isync-{1.3.6, 1.4.2}: possible remote code execution (CVE-2021-3578)

• Product: Gentoo Security
• Status: RESOLVED FIXED

[Description Kenton Groombridge 2021-06-07 15:09:36 UTC]

Subject: CVE-2021-3578: possible remote code execution in isync/mbsync

description:

A flaw was found in mbsync before v1.3.6 and v1.4.2, where an unchecked
pointer cast allows a malicious or compromised server to write an
arbitrary integer value past the end of a heap-allocated structure by
issuing an unexpected APPENDUID response. This could be plausibly
exploited for remote code execution on the client.

mitigation:

upgrade to the freshly released v1.3.6 or v1.4.2 available from 
https://sourceforge.net/projects/isync/files/isync/ , or apply the 
matching attached patch.

Reproducible: Always

[Comment 1 Larry the Git Cow 2021-06-07 16:04:58 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f35a7a7604140062a2edba6efd2c94ab54866120

commit f35a7a7604140062a2edba6efd2c94ab54866120
Author:     Sam James <[e-mail]>
AuthorDate: 2021-06-07 06:56:32 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2021-06-07 07:13:56 +0000

    net-mail/isync: add 1.4.2
    
    Bug: https://bugs.gentoo.org/794772
    Signed-off-by: Sam James <[e-mail]>

 net-mail/isync/Manifest           |  1 +
 net-mail/isync/isync-1.4.2.ebuild | 43 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 44 insertions(+)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=953ae581d25b29bc8fbf8f7c8c1139f67a74ceef

commit 953ae581d25b29bc8fbf8f7c8c1139f67a74ceef
Author:     Sam James <[e-mail]>
AuthorDate: 2021-06-07 06:56:05 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2021-06-07 07:13:55 +0000

    net-mail/isync: add 1.3.6
    
    Bug: https://bugs.gentoo.org/794772
    Signed-off-by: Sam James <[e-mail]>

 net-mail/isync/Manifest           |  1 +
 net-mail/isync/isync-1.3.6.ebuild | 42 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 43 insertions(+)

[Comment 2 Sam James 2021-06-07 23:09:11 UTC]

x86 done

[Comment 3 Agostino Sarubbo 2021-06-08 06:58:43 UTC]

amd64 stable.

Maintainer(s), please cleanup.
Security, please add it to the existing request, or file a new one.

[Comment 4 Larry the Git Cow 2021-07-24 06:19:40 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=cb486917023ba6db5019f39b73db1bc9c5a2f67d

commit cb486917023ba6db5019f39b73db1bc9c5a2f67d
Author:     Georgy Yakovlev <[e-mail]>
AuthorDate: 2021-07-24 06:19:24 +0000
Commit:     Georgy Yakovlev <[e-mail]>
CommitDate: 2021-07-24 06:19:24 +0000

    net-mail/isync: drop 1.4.1
    
    Bug: https://bugs.gentoo.org/794772
    Signed-off-by: Georgy Yakovlev <[e-mail]>

 net-mail/isync/Manifest           |  1 -
 net-mail/isync/isync-1.4.1.ebuild | 43 ---------------------------------------
 2 files changed, 44 deletions(-)

[Comment 5 Andreas K. Hüttel 2021-07-25 21:22:44 UTC]

Nothing to do here anymore

[Comment 6 NATTkA bot 2021-12-08 09:20:44 UTC]

Keywords are not fully specified and arches are not CC-ed for the following packages:

- =net-mail/isync-1.3.6

[Comment 7 John Helmert III 2022-08-10 15:49:52 UTC]

Request filed

[Comment 8 Larry the Git Cow 2022-08-10 22:33:45 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=d94e53c09885e53ce1daaa7089692d4054a2cb38

commit d94e53c09885e53ce1daaa7089692d4054a2cb38
Author:     GLSAMaker <[e-mail]>
AuthorDate: 2022-08-10 22:30:18 +0000
Commit:     John Helmert III <[e-mail]>
CommitDate: 2022-08-10 22:33:14 +0000

    [ GLSA 202208-15 ] isync: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/771738
    Bug: https://bugs.gentoo.org/794772
    Bug: https://bugs.gentoo.org/826902
    Signed-off-by: GLSAMaker <[e-mail]>
    Signed-off-by: John Helmert III <[e-mail]>

 glsa-202208-15.xml | 47 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 47 insertions(+)

[Comment 9 John Helmert III 2022-08-10 22:37:20 UTC]

GLSA released, all done!