[imapproxy-info] Debian security advisory DSA 852-1

[Dave McMurtrie]

Hi,

Steve Kemp from Debian discovered a string format specifier bug in 
imapproxy.  If you're running a Debian package already, you can wget a 
version of imapproxy with this bug fixed.

Steve notified me directly about this problem, and I wanted to advise 
everyone on the list also.  You can read the debian announcement here:

http://lists.debian.org/debian-security-announce/debian-security-announce-2005/msg00245.html

This is a bug and Steve sent me a patch that I'll apply, but I'm not 
exactly tripping over myself to fix this one in a huge hurry.  
Basically, if you set up a malicious imap server that returns a 
carefully crafted Banner line upon connection you could exploit this to 
run arbitrary code on the imapproxy machine.

The workaround, until I make a new release, will be to only point your 
imapproxy at a trusted imap server.

Thanks,

Dave