exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

fetchmail-SA-2005-01.txt

fetchmail-SA-2005-01.txt
Posted Jul 28, 2005
Authored by Matthias Andree | Site fetchmail.berlios.de

Fetchmail version 1.02 suffers from a remote code injection vulnerability.

tags | advisory, remote
advisories | CVE-2005-2335
SHA-256 | fc3f1ce80d30fc5169baa1476c5710f9cd636aec98c35ccdc729e1c419f34d2c

fetchmail-SA-2005-01.txt

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

fetchmail-SA-2005-01: security announcement

Topic: remote code injection vulnerability in fetchmail

Author: Matthias Andree
Version: 1.02
Announced: 2005-07-21
Type: buffer overrun/stack corruption/code injection
Impact: account or system compromise possible through malicious
or compromised POP3 servers
Danger: high: in sensitive configurations, a full system
compromise is possible
(for 6.2.5.1: denial of service for the whole fetchmail
system is possible)
CVE Name: CAN-2005-2335
URL: http://fetchmail.berlios.de/fetchmail-SA-2005-01.txt
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=212762
http://www.vuxml.org/freebsd/3497d7be-2fef-45f4-8162-9063751b573a.html
http://www.vuxml.org/freebsd/3f4ac724-fa8b-11d9-afcf-0060084a00e5.html
http://www.freebsd.org/cgi/query-pr.cgi?pr=83805
http://www.heise.de/security/news/meldung/62070
Thanks: Edward J. Shornock (located the bug in UIDL code)
Miloslav Trmac (pointed out 6.2.5.1 was faulty)
Ludwig Nussel (provided minimal correct fix)

Affects: fetchmail version 6.2.5.1 (denial of service)
fetchmail version 6.2.5 (code injection)
fetchmail version 6.2.0 (code injection)
(other versions have not been checked)

Not affected: fetchmail 6.2.5.2
fetchmail 6.2.6-pre7
fetchmail 6.3.0 (not released yet)

Older versions may not have THIS bug, but had been found
to contain other security-relevant bugs.

Corrected: 2005-07-22 01:37 UTC (SVN) - committed bugfix (r4157)
2005-07-22 fetchmail-patch-6.2.5.2 released
2005-07-23 fetchmail-6.2.5.2 tarball released

0. Release history

2005-07-20 1.00 - Initial announcement
2005-07-22 1.01 - Withdrew 6.2.5.1 and 6.2.6-pre5, the fix was buggy
and susceptible to denial of service through
single-byte read from 0 when either a Message-ID:
header was empty (in violation of RFC-822/2822)
or the UIDL response did not contain an UID (in
violation of RFC-1939).
- Add Credits.
- Add 6.2.5.1 failure details to sections 2 and 3
- Revise section 5 and B.
2005-07-26 1.02 - Revise section 0.
- Add FreeBSD VuXML URL for 6.2.5.1.
- Add heise security URL.
- Mention release of 6.2.5.2 tarball.

1. Background

fetchmail is a software package to retrieve mail from remote POP2, POP3,
IMAP, ETRN or ODMR servers and forward it to local SMTP, LMTP servers or
message delivery agents.

2. Problem description

The POP3 code in fetchmail-6.2.5 and older that deals with UIDs (from
the UIDL) reads the responses returned by the POP3 server into
fixed-size buffers allocated on the stack, without limiting the input
length to the buffer size. A compromised or malicious POP3 server can
thus overrun fetchmail's stack. This affects POP3 and all of its
variants, for instance but not limited to APOP.

In fetchmail-6.2.5.1, the attempted fix prevented code injection via
POP3 UIDL, but introduced two possible NULL dereferences that can be
exploited to mount a denial of service attack.

3. Impact

In fetchmail-6.2.5 and older, very long UIDs can cause fetchmail to
crash, or potentially make it execute code placed on the stack. In some
configurations, fetchmail is run by the root user to download mail for
multiple accounts.

In fetchmail-6.2.5.1, a server that responds with UID lines containing
only the article number but no UID (in violation of RFC-1939), or a
message without Message-ID when no UIDL support is available, can crash
fetchmail.

4. Workaround

No reasonable workaround can be offered at this time.

5. Solution

Upgrade your fetchmail package to version 6.2.5.2.

You can either download a complete tarball of fetchmail-6.2.5.2.tar.gz,
or you can download a patch against fetchmail-6.2.5 if you already have
the 6.2.5 tarball. Either is available from:

<http://developer.berlios.de/project/showfiles.php?group_id=1824>

To use the patch:

1. download fetchmail-6.2.5.tar.gz (or retrieve the version you already
had downloaded) and fetchmail-patch-6.2.5.2.tar.gz
2. unpack the tarball: gunzip -c fetchmail-6.2.5.tar.gz | tar xf -
3. unpack the patch: gunzip fetchmail-patch-6.2.5.2.gz
4. apply the patch: cd fetchmail-6.2.5 ; patch -p1 <../fetchmail-patch-6.2.5.2
5. now configure and build as usual - detailed instructions in the file
named "INSTALL".

A. References

fetchmail home page: <http://fetchmail.berlios.de/>

B. Copyright, License and Warranty

(C) Copyright 2005 by Matthias Andree, <matthias.andree@gmx.de>.
Some rights reserved.

This work is licensed under the Creative Commons
Attribution-NonCommercial-NoDerivs German License. To view a copy of
this license, visit http://creativecommons.org/licenses/by-nc-nd/2.0/de/
or send a letter to Creative Commons; 559 Nathan Abbott Way;
Stanford, California 94305; USA.

THIS WORK IS PROVIDED FREE OF CHARGE AND WITHOUT ANY WARRANTIES.
Use the information herein at your own risk.

END OF fetchmail-SA-2005-01.txt
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (GNU/Linux)

iD8DBQFC5lpIvmGDOQUufZURAlv1AKCUuwHKgC/lln+fhYgt8Ba6VxI1WQCgpmBj
SLivUn3+6/zifjC4Hnaw0uc=
=PebP
-----END PGP SIGNATURE-----
Login or Register to add favorites

File Archive:

October 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    39 Files
  • 2
    Oct 2nd
    23 Files
  • 3
    Oct 3rd
    18 Files
  • 4
    Oct 4th
    20 Files
  • 5
    Oct 5th
    0 Files
  • 6
    Oct 6th
    0 Files
  • 7
    Oct 7th
    17 Files
  • 8
    Oct 8th
    66 Files
  • 9
    Oct 9th
    0 Files
  • 10
    Oct 10th
    0 Files
  • 11
    Oct 11th
    0 Files
  • 12
    Oct 12th
    0 Files
  • 13
    Oct 13th
    0 Files
  • 14
    Oct 14th
    0 Files
  • 15
    Oct 15th
    0 Files
  • 16
    Oct 16th
    0 Files
  • 17
    Oct 17th
    0 Files
  • 18
    Oct 18th
    0 Files
  • 19
    Oct 19th
    0 Files
  • 20
    Oct 20th
    0 Files
  • 21
    Oct 21st
    0 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2024 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close