Re: response to the bugtraq report of buffer overruns in imapd LIST command

[MRC () CAC WASHINGTON EDU (Mark Crispin)]

On Mon, 17 Apr 2000 23:02:48 -0700, R. C. Dowdeswell wrote:
> Using chroot in a lot of situations is rather dangerous, and one
> must carefully set up the environment that it runs in.

Yes.  This is why I would never do it by default; it's something that the site
has to turn on explictly (and they have to rebuild; it will not be in any
prebuilt binaries).  But thanks for reminding me; I am certainly going to
document that gotcha.  It probably still is valuable for some sites, but it
should never be set for sites that permit shell access.

The ability to break out of chroot while having root privileges is a not an
issue.  The code discards root privileges immediately after the chroot.  It's
also chdir'd to the new root.

Absurdly long mailbox names will not be permitted in the next release, so the
silly problem that triggered all of this foofaraw won't be an issue either.