CVE request - uw-imap

[Tomas Hoger <thoger () redhat com>]

Hi!

uw-imap upstream released new version 2007d on friday, announcing it as
security update fixing some issues in dmail and tmail utilities:

http://mailman2.u.washington.edu/pipermail/imap-uw/2008-October/002267.html
http://mailman2.u.washington.edu/pipermail/imap-uw/2008-October/002268.html

Further digging into this, the issue seem to be a buffer overflow
(strcpy) when handling command line arguments (overlong mailbox
specification when utility is called with user+folder argument). This
can have security implications in the setups where tmail is installed 
setuid root (according to the resources I found, that's required in
certain configurations; dmail is not expected to run under different
user), or when one of the utilities is configured as deliver agent in
the MTA.

Some further info I managed to collect is in our BZ:
https://bugzilla.redhat.com/show_bug.cgi?id=469667

-- 
Tomas Hoger / Red Hat Security Response Team