Debians sikkerhedsbulletin

DSA-216-1 fetchmail -- bufferoverløb

Rapporteret den:
24. dec 2002
Berørte pakker:
fetchmail
Sårbar:
Ja
Referencer i sikkerhedsdatabaser:
I Bugtraq-databasen (hos SecurityFocus): BugTraq-id 6390.
I Mitres CVE-ordbog: CVE-2002-1365.
Yderligere oplysninger:

Stefan Esser fra e-matters har opdaget et bufferoverløb i fetchmail, et indsamlings-/videredesendelseprogram til e-mail, med mulighed for SSL og understøttelse af POP3, APOP og IMAP. Når fetchmail henter en e-mail, gennemsøges alle headerlinier for lokale adresser. Hvis et værtsnavn (hostname) mangler, tilføjer fetchmail det, men reserverer ikke plads nok til det. Dette stakoverløb kan anvendes af fjernangribere til at få programmet til at gå ned, eller til at udføre vilkårlig kode med rettighederne tilhørende den bruger, som anvender fetchmail.

I den aktuelle stabile distribution (woody) er dette problem rettet i version 5.9.11-6.2 af fetchmail og fetchmail-ssl.

I den gamle stabile distribution (potato) er dette problem rettet version 5.3.3-4.3.

I den ustabile distribution (sid) er dette problem rettet i version 6.2.0-1 af fetchmail og fetchmail-ssl.

Vi anbefaler at du opgraderer dine fetchmail-pakker.

Rettet i:

Debian GNU/Linux 2.2 (potato)

Kildekode:
http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_5.3.3-4.3.dsc
http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_5.3.3-4.3.diff.gz
http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_5.3.3.orig.tar.gz
Arkitekturuafhængig komponent:
http://security.debian.org/pool/updates/main/f/fetchmail/fetchmailconf_5.3.3-4.3_all.deb
Alpha:
http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_5.3.3-4.3_alpha.deb
ARM:
http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_5.3.3-4.3_arm.deb
Intel IA-32:
http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_5.3.3-4.3_i386.deb
Motorola 680x0:
http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_5.3.3-4.3_m68k.deb
PowerPC:
http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_5.3.3-4.3_powerpc.deb
Sun Sparc:
http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_5.3.3-4.3_sparc.deb

Debian GNU/Linux 3.0 (woody)

Kildekode:
http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_5.9.11-6.2.dsc
http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_5.9.11-6.2.diff.gz
http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_5.9.11.orig.tar.gz
http://security.debian.org/pool/updates/main/f/fetchmail-ssl/fetchmail-ssl_5.9.11-6.2.dsc
http://security.debian.org/pool/updates/main/f/fetchmail-ssl/fetchmail-ssl_5.9.11-6.2.diff.gz
http://security.debian.org/pool/updates/main/f/fetchmail-ssl/fetchmail-ssl_5.9.11.orig.tar.gz
Arkitekturuafhængig komponent:
http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail-common_5.9.11-6.2_all.deb
http://security.debian.org/pool/updates/main/f/fetchmail/fetchmailconf_5.9.11-6.2_all.deb
Alpha:
http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_5.9.11-6.2_alpha.deb
http://security.debian.org/pool/updates/main/f/fetchmail-ssl/fetchmail-ssl_5.9.11-6.2_alpha.deb
ARM:
http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_5.9.11-6.2_arm.deb
http://security.debian.org/pool/updates/main/f/fetchmail-ssl/fetchmail-ssl_5.9.11-6.2_arm.deb
Intel IA-32:
http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_5.9.11-6.2_i386.deb
http://security.debian.org/pool/updates/main/f/fetchmail-ssl/fetchmail-ssl_5.9.11-6.2_i386.deb
Intel IA-64:
http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_5.9.11-6.2_ia64.deb
http://security.debian.org/pool/updates/main/f/fetchmail-ssl/fetchmail-ssl_5.9.11-6.2_ia64.deb
HPPA:
http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_5.9.11-6.2_hppa.deb
http://security.debian.org/pool/updates/main/f/fetchmail-ssl/fetchmail-ssl_5.9.11-6.2_hppa.deb
Motorola 680x0:
http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_5.9.11-6.2_m68k.deb
http://security.debian.org/pool/updates/main/f/fetchmail-ssl/fetchmail-ssl_5.9.11-6.2_m68k.deb
Big endian MIPS:
http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_5.9.11-6.2_mips.deb
http://security.debian.org/pool/updates/main/f/fetchmail-ssl/fetchmail-ssl_5.9.11-6.2_mips.deb
Little endian MIPS:
http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_5.9.11-6.2_mipsel.deb
http://security.debian.org/pool/updates/main/f/fetchmail-ssl/fetchmail-ssl_5.9.11-6.2_mipsel.deb
PowerPC:
http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_5.9.11-6.2_powerpc.deb
http://security.debian.org/pool/updates/main/f/fetchmail-ssl/fetchmail-ssl_5.9.11-6.2_powerpc.deb
IBM S/390:
http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_5.9.11-6.2_s390.deb
http://security.debian.org/pool/updates/main/f/fetchmail-ssl/fetchmail-ssl_5.9.11-6.2_s390.deb
Sun Sparc:
http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_5.9.11-6.2_sparc.deb
http://security.debian.org/pool/updates/main/f/fetchmail-ssl/fetchmail-ssl_5.9.11-6.2_sparc.deb

MD5-kontrolsummer for de listede filer findes i den originale sikkerhedsbulletin.