Re: remote root qmail-pop with vpopmail advisory and exploit with patch (fwd)

[Russ Allbery]

Russell Nelson <[EMAIL PROTECTED]> writes:

> Securing vchkpop.  There is no reason to limit the username or password
> information to 40 characters, even if the RFC does say to do it.

That's not what the RFC says.  The RFC says that the *client* shall not
send arguments in excess of 40 characters in the absence of extensions.
It says nothing at all about what the server should do if it receives
arguments in excess of 40 characters.

-- 
Russ Allbery ([EMAIL PROTECTED])         <URL:http://www.eyrie.org/~eagle/>