SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (E-mail Client)  >   Fetchmail Vendors:   Raymond, Eric S.
(Caldera Issues Fix) Fetchmail Client Buffer Overflow May Allow a Remote Mail Server to Execute Arbitrary Code on the Client System
SecurityTracker Alert ID:  1004563
SecurityTracker URL:  http://securitytracker.com/id/1004563
CVE Reference:   CVE-2002-0146   (Links to External Site)
Date:  Jun 17 2002
Impact:   Denial of service via network, Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 5.9.9 and prior versions
Description:   A buffer overflow vulnerability was reported in 'fetchmail'. A malicious remote server could cause arbitrary code to be executed on the system running 'fetchmail'.

It is reported that the fetchmail client will trust data supplied by the remote server when retrieving mail from an IMAP server. The client allocates an array to store the sizes of the messages which it will attempt to download from the server and trusts the number of messages that the server claims to have.

A malicious remote server could return an incorrect value causing the fetchmail process to write data outside of the allocated array boundary. This could result in a denial of service condition or arbitrary code being executed on the fetchmail system.

Impact:   A malicious remote IMAP server could cause the fetchmail client to crash or to execute arbitrary code when downloading messages from the mail server. The code would run with the privileges of the 'fetchmail' process.
Solution:   Caldera has released a fix for OpenLinux Server and Workstation.

For OpenLinux 3.1.1 Server:

Package Location

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/RPMS

Packages

fe2a12a46105337465eaade27dcdfd19 fetchmail-5.8.17-3.i386.rpm
5ee700b144f9888d71760c68af7bdd10 fetchmailconf-5.8.17-3.i386.rpm

Installation

rpm -Fvh fetchmail-5.8.17-3.i386.rpm
rpm -Fvh fetchmailconf-5.8.17-3.i386.rpm

Source Package Location

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/SRPMS

Source Packages

d0baecda18a7f2602fe2b1634463addb fetchmail-5.8.17-3.src.rpm


For OpenLinux 3.1.1 Workstation:

Package Location

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/current/RPMS

Packages

e53982b3b4bd650aeca7342b155fd150 fetchmail-5.8.17-3.i386.rpm
66c50c0b2a80a01e5a6b80ee10b999cb fetchmailconf-5.8.17-3.i386.rpm

Installation

rpm -Fvh fetchmail-5.8.17-3.i386.rpm
rpm -Fvh fetchmailconf-5.8.17-3.i386.rpm

Source Package Location:

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/current/SRPMS

Source Packages

282f59e2897e214270789b9bd12b1ebe fetchmail-5.8.17-3.src.rpm


For OpenLinux 3.1 Server:

Package Location

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/RPMS

Packages

4e1d00de455d83703ef352b6954a26b5 fetchmail-5.8.17-3.i386.rpm
0d86128975e46e9e739728157e4c8eef fetchmailconf-5.8.17-3.i386.rpm

Installation

rpm -Fvh fetchmail-5.8.17-3.i386.rpm
rpm -Fvh fetchmailconf-5.8.17-3.i386.rpm

Source Package Location

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/SRPMS

Source Packages

94f1a2221da6db44c31f5562a8935b83 fetchmail-5.8.17-3.src.rpm


For OpenLinux 3.1 Workstation:

Package Location

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/current/RPMS

Packages

7b6142d18892c4a4afe6a956f3a8ae51 fetchmail-5.8.17-3.i386.rpm
6ca58cc1462555b90ff4b5c3a395adb8 fetchmailconf-5.8.17-3.i386.rpm

Installation

rpm -Fvh fetchmail-5.8.17-3.i386.rpm
rpm -Fvh fetchmailconf-5.8.17-3.i386.rpm

Source Package Location

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/current/SRPMS

Source Packages

296fb5b80dbd73aefffad24b3998f33c fetchmail-5.8.17-3.src.rpm

Vendor URL:  www.tuxedo.org/~esr/fetchmail/ (Links to External Site)
Cause:   Boundary error
Underlying OS:  Linux (Caldera/SCO)
Underlying OS Comments:  OpenLinux 3.1, 3.1.1; Server and Workstation

Message History:   This archive entry is a follow-up to the message listed below.
May 21 2002 Fetchmail Client Buffer Overflow May Allow a Remote Mail Server to Execute Arbitrary Code on the Client System



 Source Message Contents

Subject:  Security Update: [CSSA-2002-027.0] Linux: fetchmail imap message count vulnerability


--T4sUOijqQbZv57TR
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

To: bugtraq@securityfocus.com announce@lists.caldera.com security-alerts@linuxsecurity.com

______________________________________________________________________________

		Caldera International, Inc.  Security Advisory

Subject:		Linux: fetchmail imap message count vulnerability
Advisory number: 	CSSA-2002-027.0
Issue date: 		2002 June 17
Cross reference:
______________________________________________________________________________


1. Problem Description

	The fetchmail email client does not properly limit the maximum
	number of messages available. This allows a remote IMAP server to
	overwrite memory via a message count that exceeds the boundaries
	of an array.


2. Vulnerable Supported Versions

	System				Package
	----------------------------------------------------------------------

	OpenLinux 3.1.1 Server		prior to fetchmail-5.8.17-3.i386.rpm
					prior to fetchmailconf-5.8.17-3.i386.rpm

	OpenLinux 3.1.1 Workstation	prior to fetchmail-5.8.17-3.i386.rpm
					prior to fetchmailconf-5.8.17-3.i386.rpm

	OpenLinux 3.1 Server		prior to fetchmail-5.8.17-3.i386.rpm
					prior to fetchmailconf-5.8.17-3.i386.rpm

	OpenLinux 3.1 Workstation	prior to fetchmail-5.8.17-3.i386.rpm
					prior to fetchmailconf-5.8.17-3.i386.rpm


3. Solution

	The proper solution is to install the latest packages.


4. OpenLinux 3.1.1 Server

	4.1 Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/RPMS

	4.2 Packages

	fe2a12a46105337465eaade27dcdfd19	fetchmail-5.8.17-3.i386.rpm
	5ee700b144f9888d71760c68af7bdd10	fetchmailconf-5.8.17-3.i386.rpm

	4.3 Installation

	rpm -Fvh fetchmail-5.8.17-3.i386.rpm
	rpm -Fvh fetchmailconf-5.8.17-3.i386.rpm

	4.4 Source Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/SRPMS

	4.5 Source Packages

	d0baecda18a7f2602fe2b1634463addb	fetchmail-5.8.17-3.src.rpm


5. OpenLinux 3.1.1 Workstation

	5.1 Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/current/RPMS

	5.2 Packages

	e53982b3b4bd650aeca7342b155fd150	fetchmail-5.8.17-3.i386.rpm
	66c50c0b2a80a01e5a6b80ee10b999cb	fetchmailconf-5.8.17-3.i386.rpm

	5.3 Installation

	rpm -Fvh fetchmail-5.8.17-3.i386.rpm
	rpm -Fvh fetchmailconf-5.8.17-3.i386.rpm

	5.4 Source Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/current/SRPMS

	5.5 Source Packages

	282f59e2897e214270789b9bd12b1ebe	fetchmail-5.8.17-3.src.rpm


6. OpenLinux 3.1 Server

	6.1 Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/RPMS

	6.2 Packages

	4e1d00de455d83703ef352b6954a26b5	fetchmail-5.8.17-3.i386.rpm
	0d86128975e46e9e739728157e4c8eef	fetchmailconf-5.8.17-3.i386.rpm

	6.3 Installation

	rpm -Fvh fetchmail-5.8.17-3.i386.rpm
	rpm -Fvh fetchmailconf-5.8.17-3.i386.rpm

	6.4 Source Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/SRPMS

	6.5 Source Packages

	94f1a2221da6db44c31f5562a8935b83	fetchmail-5.8.17-3.src.rpm


7. OpenLinux 3.1 Workstation

	7.1 Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/current/RPMS

	7.2 Packages

	7b6142d18892c4a4afe6a956f3a8ae51	fetchmail-5.8.17-3.i386.rpm
	6ca58cc1462555b90ff4b5c3a395adb8	fetchmailconf-5.8.17-3.i386.rpm

	7.3 Installation

	rpm -Fvh fetchmail-5.8.17-3.i386.rpm
	rpm -Fvh fetchmailconf-5.8.17-3.i386.rpm

	7.4 Source Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/current/SRPMS

	7.5 Source Packages

	296fb5b80dbd73aefffad24b3998f33c	fetchmail-5.8.17-3.src.rpm


8. References

	Specific references for this advisory:
		http://tuxedo.org/~esr/fetchmail/NEWS
		http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0146

	Caldera security resources:
		http://www.caldera.com/support/security/index.html

	This security fix closes Caldera incidents sr865008, fz521068,
	erg712057.


9. Disclaimer

	Caldera International, Inc. is not responsible for the misuse
	of any of the information we provide on this website and/or
	through our security advisories. Our advisories are a service
	to our customers intended to promote secure installation and
	use of Caldera products.

______________________________________________________________________________

--T4sUOijqQbZv57TR
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (SCO_SV)
Comment: For info see http://www.gnupg.org

iEYEARECAAYFAj0OXE0ACgkQbluZssSXDTFtDwCdHQT78/fucbTRsQKByxTRd/YE
l04An0pk+kqhmOiJHLeDwPbOBFotgu4R
=Awds
-----END PGP SIGNATURE-----

--T4sUOijqQbZv57TR--

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, SecurityGlobal.net LLC