-----BEGIN PGP SIGNED MESSAGE-----

===============================================================================
Security Advisory                                                       CERT-NL
===============================================================================
Author/Source : Rene Ritzen                                 Index  :    S-97-23
Distribution  : World                                       Page   :          1
Classification: External                                    Version:          2
Subject       : Vulnerability in IMAP and POP               Date   :   9-Apr-97
===============================================================================

Unfortunately an error occurred in S97-23 version 1.
The URL for the CERT/CC mirror was not correct.
S97-23 version 2 (this one) is correct.

By courtesy of CERT Coordination Center we received an update on CERT
Coordination Center advisory CA-97.09 about a vulnerability in IMAP and POP.

The CERT Coordination Center has received reports of a vulnerability
in some versions of the Internet Message Access Protocol (IMAP) and
Post Office Protocol (POP) implementations (imapd, ipop2d, and
ipop3d). Information about this vulnerability has been publicly
distributed.

By exploiting this vulnerability, remote users can obtain unauthorized root
access.

The CERT/CC team recommends installing a patch if one is available or
upgrading to IMAP4rev1. Until you can do so, we recommend disabling the IMAP
and POP services at your site.


CERT-NL recommends to apply this new patch, if applicable.

All CERT Coordination Center advisories and README's are mirrored by CERT-NL.
The specific URL's for this case is:

  ftp://ftp.surfnet.nl/surfnet/net-security/cert-cc-mirror/
  cert_advisories/CA-97.09.imap.pop.Z

More information about the CERT-NL mirror and notifier services is
contained in News items N-95-01 (notifier) and N-95-02 (CERT mirror),
both present on ftp://ftp.surfnet.nl/surfnet/net-security/cert-nl/docs/news/

==============================================================================

CERT-NL is the Computer Emergency Response Team for SURFnet customers.
SURFnet is the Dutch network for educational, research and related institutes.
CERT-NL is a member of the Forum of Incident Response and Security Teams
(FIRST).

All CERT-NL material is available under:
  http://www.surfnet.nl/surfnet/security/cert-nl.html
  ftp://ftp.surfnet.nl/surfnet/net-security

In case of computer or network security problems please contact your
local CERT/security-team or CERT-NL  (if your institute is NOT a SURFnet
customer please address the appropriate (local) CERT/security-team).

CERT-NL is one/two hour(s) ahead of UTC (GMT) in winter/summer,
i.e. UTC+0100 in winter and UTC+0200 in summer (DST).
   Email:     cert-nl@surfnet.nl
   Phone:     +31 302 305 305
   Fax:       +31 302 305 329
   Snailmail: SURFnet bv
              Attn. CERT-NL
              P.O. Box 19035
              NL - 3501 DA  UTRECHT
              The Netherlands
   A 7 * 24 hours phone number is available to SURFnet SSC's and FIRST
   members on request.
==============================================================================




-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv

iQCVAwUBM0tH8EU5nQkWIq1FAQHgMwP/WfBKNdj3PF6eaJuI0i7VO3nQsrW73/8Q
a+hKjExbZ8oes7QE08s5VWknBQgc732LA2g0WBBdFTaTfrGgSx2bjyV8ZPEF3FsU
uNMqaaKpDpqh+xejwzIxsJd783hUaKKMUO/P16vTm1tHP4BfnNrP4+YE61fo0Wno
wl5QevJ6Ujk=
=i8QR
-----END PGP SIGNATURE-----