diff options
Diffstat (limited to 'fetchmail-SA-2005-01.txt')
| -rw-r--r-- | fetchmail-SA-2005-01.txt | 78 |
1 files changed, 54 insertions, 24 deletions
diff --git a/fetchmail-SA-2005-01.txt b/fetchmail-SA-2005-01.txt index d9e9aa2a..4a76a74e 100644 --- a/fetchmail-SA-2005-01.txt +++ b/fetchmail-SA-2005-01.txt @@ -3,7 +3,7 @@ fetchmail-SA-2005-01: security announcement Topic: remote code injection vulnerability in fetchmail Author: Matthias Andree -Version: 1.00 +Version: 1.01 Announced: 2005-07-21 Type: buffer overrun/stack corruption/code injection Impact: account or system compromise possible through malicious @@ -15,24 +15,36 @@ URL: http://fetchmail.berlios.de/fetchmail-SA-2005-01.txt http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=212762 http://www.vuxml.org/freebsd/3497d7be-2fef-45f4-8162-9063751b573a.html http://www.freebsd.org/cgi/query-pr.cgi?pr=83805 +Thanks: Edward J. Shornock (located the bug in UIDL code) + Miloslav Trmac (pointed out 6.2.5.1 was faulty) + Ludwig Nussel (provided minimal fix) -Affects: fetchmail version 6.2.5 - fetchmail version 6.2.0 +Affects: fetchmail version 6.2.5.1 (denial of service) + fetchmail version 6.2.5 (code injection) + fetchmail version 6.2.0 (code injection) (other versions have not been checked) -Not affected: fetchmail 6.2.5.1 - fetchmail 6.2.6-pre5 (not released yet) +Not affected: fetchmail 6.2.5.2 + fetchmail 6.2.6-pre6 fetchmail 6.3.0 (not released yet) Older versions may not have THIS bug, but had been found to contain other security-relevant bugs. -Corrected: 2005-07-20 15:22 UTC (SVN) - committed bugfix (r4143) - 2005-07-20 fetchmail-patch-6.2.5.1 released +Corrected: 2005-07-22 01:37 UTC (SVN) - committed bugfix (r4157) + 2005-07-22 fetchmail-patch-6.2.5.2 released 0. Release history -2005-07-20 1.00 initial announcement +2005-07-20 1.00 - Initial announcement +2005-07-22 1.01 - Withdrew 6.2.5.1 and 6.2.6-pre5, the fix was buggy + and susceptible to denial of service through + single-byte read from 0 when either a Message-ID: + header was empty or the UIDL response did not + contain an URL. + - Add Credits. + - Add 6.2.5.1 failure details to sections 2 and 3 + - Revise section 5 and B. 1. Background @@ -42,18 +54,28 @@ message delivery agents. 2. Problem description -The POP3 code that deals with UIDs (from the UIDL) reads the responses -returned by the POP3 server into fixed-size buffers allocated on the -stack, without limiting the input length to the buffer size. A -compromised or malicious POP3 server can thus overrun fetchmail's stack. -This affects POP3 and all of its variants, for instance but not limited -to APOP. +The POP3 code in fetchmail-6.2.5 and older that deals with UIDs (from +the UIDL) reads the responses returned by the POP3 server into +fixed-size buffers allocated on the stack, without limiting the input +length to the buffer size. A compromised or malicious POP3 server can +thus overrun fetchmail's stack. This affects POP3 and all of its +variants, for instance but not limited to APOP. + +In fetchmail-6.2.5.1, the attempted fix prevented code injection via +POP3 UIDL, but introduced two possible NULL dereferences that can be +exploited to mount a denial of service attack. 3. Impact -Very long UIDs can cause fetchmail to crash, or potentially make it -execute code placed on the stack. In some configurations, fetchmail -is run by the root user to download mail for multiple accounts. +In fetchmail-6.2.5 and older, very long UIDs can cause fetchmail to +crash, or potentially make it execute code placed on the stack. In some +configurations, fetchmail is run by the root user to download mail for +multiple accounts. + +In fetchmail-6.2.5.1, a server that responds with UID lines containing +only the article number but no UID (in violation of RFC-1939), or a +message without Message-ID when no UIDL support is available, can crash +fetchmail. 4. Workaround @@ -61,23 +83,28 @@ No reasonable workaround can be offered at this time. 5. Solution -Upgrade your fetchmail package to version 6.2.5.1. +Upgrade your fetchmail package to version 6.2.5.2. + This requires the download of the fetchmail-6.2.5.tar.gz tarball and the -fetchmail-patch-6.2.5.1.gz from BerliOS: +fetchmail-patch-6.2.5.2.gz from BerliOS: <http://developer.berlios.de/project/showfiles.php?group_id=1824> -Note that the files may be hidden from view later as new releases become -available. +To use the patch: -Instructions for patching are given at -<http://developer.berlios.de/forum/forum.php?forum_id=13104> + 1. download fetchmail-6.2.5.tar.gz (or retrieve the version you already + had downloaded) and fetchmail-patch-6.2.5.2.tar.gz + 2. unpack the tarball: gunzip -c fetchmail-6.2.5.tar.gz | tar xf - + 3. unpack the patch: gunzip fetchmail-patch-6.2.5.2.gz + 4. apply the patch: cd fetchmail-6.2.5 ; patch -p1 <../fetchmail-patch-6.2.5.2 + 5. now configure and build as usual - detailed instructions in the file + named "INSTALL". A. References fetchmail home page: <http://fetchmail.berlios.de/> -B. Copyright and License +B. Copyright, License and Warranty (C) Copyright 2005 by Matthias Andree, <matthias.andree@gmx.de>. Some rights reserved. @@ -88,4 +115,7 @@ this license, visit http://creativecommons.org/licenses/by-nc-nd/2.0/de/ or send a letter to Creative Commons; 559 Nathan Abbott Way; Stanford, California 94305; USA. +THIS WORK IS PROVIDED FREE OF CHARGE AND WITHOUT ANY WARRANTIES. +Use the information herein at your own risk. + END OF fetchmail-SA-2005-01.txt |