Re: [gentoo-security] courier-imap

[Ned Ludd]

On Thu, 2004-03-25 at 22:27, Ben Cressey wrote:
> Is there some reason a GLSA was not issued about this vulnerability?  I've
> been vulnerable for two weeks now without realizing it, and who knows how
> much longer it will be until the patch is made available.

Yeah.. We don't provide a vulnerability announcement/assessment service.
We provide updates when they exist. If you would like a vulnerability
announcement service then you should pay. Or simply track the
security@g.o via bugzilla as most us do.

>
> It seems I missed the post to Bugtraq since it was issued as a Courier
> vulnerability, and I didn't read carefully enough to discover that Courier
> IMAP was also affected.  Certainly this is my own fault, but I am just
> astonished that without Francisco's post I might have overlooked this
> serious problem altogether.
>
> Ben
>
>
>
> ----- Original Message -----
> From: "Francisco Andrades" <fandrades@×××××.com>
> To: <gentoo-security@l.g.o>
> Sent: Thursday, March 25, 2004 9:25 PM
> Subject: [gentoo-security] courier-imap
>
>
> WARNING: Unsanitized content follows.
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Greetings all,
>
> I access my mail in my gentoo-linux home server from the outside world using
> Courier IMAP. The latest version available (as of this morning) is:
>
> terminus root # emerge -s courier-imap
>
> *  net-mail/courier-imap
>       Latest version available: 2.1.2-r1
>       Latest version installed: 2.1.2-r1
>       Size of downloaded files: 1,276 kB
>       Homepage:    http://www.courier-mta.org/
>       Description: An IMAP daemon designed specifically for maildirs
>       License:     GPL-2
>
> As per the following advisory there is a vulnerability in the 2.1.2 version
> of
> Courier IMAP:
>
> http://www.securityfocus.com/bid/9845
>
> I've been trying to update this package since I received the advisory but
> have
> not noticed any update. I wanted to know if the current version is already
> patched (the r1) or are there any plans to update the available version.
>
> Thanks
>
> - --
> Francisco Andrades Grassi
> www.nextj.com
> Tlf: [phone]
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.4 (GNU/Linux)
>
> iD8DBQFAY5SwGQPFH+shC0oRApvPAKCHcJVzq7qFPja6nzTbm7lCq3XLLgCeIPPg
> zbXGWdvNaumRWsSCw4r9n+E=
> =VrBD
> -----END PGP SIGNATURE-----
>
> --
> gentoo-security@g.o mailing list
>
>
>
> --
> gentoo-security@g.o mailing list
-- 
Ned Ludd <solar@g.o>
Gentoo Linux Developer