Fetchmail address header heap buffer overflow
| fetchmail-address-header-bo (10839) |  High Risk |
Description:
Fetchmail is vulnerable to a buffer overflow, caused by improper handling of multiple local addresses in mail headers. By sending a malicious email containing multiple local reply-to addresses in the email header, a remote attacker could overflow a buffer and cause Fetchmail to crash or execute arbitrary code on the system with privileges of the Fetchmail user, once the message is retrieved by Fetchmail.
Consequences:
Gain Access
Remedy:
Upgrade to the latest version of Fetchmail (6.2.0 or later), available from the Fetchmail Web page. See References.
For Gentoo Linux:
Upgrade versions net-mail/fetchmail-6.1.2 and earlier, as listed in Gentoo Linux Security Announcement 200212-3. See References.
For Conectiva Linux:
Upgrade to the latest fetchmail package, as listed below. Refer to Conectiva Linux Announcement CLSA-2002:554 for more information. See References.
Conectiva Linux 6.0: 5.9.12-1U60_4cl or later
Conectiva Linux 7.0: 5.9.12-1U70_4cl or later
Conectiva Linux 8.0: 5.9.12-1U80_3cl or later
For Red Hat Linux:
Upgrade to the latest Fetchmail package, as listed below. Refer to RHSA-2002:293-09 for more information. See References.
Red Hat 6.2: 5.9.0-21.6.2 or later
Red Hat 7.0 and 7.1: 5.9.0-21.7.1 or later
Red Hat 7.2 and 7.3: 5.9.0-21.7.3 or later
Red Hat 8.0: 5.9.0-21.8.0 or later
For OpenPKG:
Upgrade to the latest fetchmail package, as listed below. Refer to OpenPKG Security Advisory OpenPKG-SA-2002.016 for more information. See References.
OpenPKG 1.0: 5.9.5-1.0.1 or later
OpenPKG 1.1: 5.9.13-1.1.1 or later
OpenPKG CURRENT: 6.2.0-20021213 or later
For Debian GNU/Linux:
Upgrade to the latest fetchmail package, as listed below. Refer to DSA-216-1 for more information. See References.
Debian GNU/Linux 2.2 (potato): 5.3.3-4.3 or later
Debian GNU/Linux 3.0 (woody): 5.9.11-6.2 or later
For SuSE Linux:
Upgrade to the latest OpenSSL package, as listed below. Refer to SuSE Security Announcement SuSE-SA:2003:001 for more information. See References.
SuSE Linux 8.0 (Intel): 5.9.0-279 or later
SuSE Linux 7.3 (Intel): 5.9.0-280 or later
SuSE Linux 7.3 (Sparc): 5.9.0-66 or later
SuSE Linux 7.3 (PPC): 5.9.0-205 or later
SuSE Linux 7.2 (Intel): 5.8.0-78 or later
SuSE Linux 7.1 (Intel): 5.6.5-40 or later
SuSE Linux 7.1 (AXP): 5.6.5-30 or later
SuSE Linux 7.1 (PPC): 5.6.5-29 or later
For Caldera OpenLinux 3.1 and 3.1.1 (Workstation and Server):
Upgrade to the latest fetchmail package (6.1.0-4 or later), as listed in SCO Security Advisory CSSA-2003-001.0. See References.
For EnGarde Secure Linux Community Edition:
Upgrade to the latest fetchmail-ssl package (6.1.0-1.0.6 or later), as listed in EnGarde Secure Linux Security Advisory 20030127-002. See References.
For Mandrake Linux:
Upgrade to the latest fetchmail package, as listed below. Refer to MandrakeSoft Security Advisory MDKSA-2003:011:fetchmail for more information. See References.
Mandrake Linux 7.2, 8.0, 8.1, 8.2, 9.0, and Single Network Firewall 7.2: 6.1.0-1.1mdk or later
For Immunix 7+:
Upgrade to the latest version of fetchmail (5.9.0-10_imnx_1 or later), as listed in Immunix Secured OS Security Advisory IMNX-2003-7+-023-01. See References.
For other distributions:
Contact your vendor for upgrade or patch information.
References:
- Conectiva Linux Announcement CLSA-2002:554: Remote vulnerability.
- e-matters Security Advisory 05/2002: Fetchmail remote vulnerability.
- EnGarde Secure Linux Security Advisory ESA-20030127-002: heap overflow vulnerability. (From LinuxSecurity archive)
- EnGarde Secure Linux Security Advisory ESA-20030127-002: heap overflow vulnerability. (From LinuxSecurity archive)
- Fetchmail Web Page: The fetchmail Home Page.
- Gentoo Linux Security Announcement 200212-3: buffer overflow. (From LinuxSecurity archive)
- Immunix Secured OS Security Advisory IMNX-2003-7+-023-01: fetchmail, fetchmailconf. (From LinuxSecurity archive)
- SCO Security Advisory CSSA-2003-001.0: Linux: fetchmail at-sign buffer overflow vulnerability. (From LinuxSecurity archive)
- SCO Security Advisory CSSA-2003-001.0: Linux: fetchmail at-sign buffer overflow vulnerability.
- BID-6390: Eric S. Raymond Fetchmail Heap Corruption Vulnerability
- CVE-2002-1365: Heap-based buffer overflow in Fetchmail 6.1.3 and earlier does not account for the @ character when determining buffer lengths for local addresses, which allows remote attackers to execute arbitrary code via a header with a large number of local addresses.
- DSA-216: fetchmail -- buffer overflow
- MDKSA-2003:011: Updated fetchmail packages fix remote exploit vulnerability
- OpenPKG-SA-2002.016: fetchmail
- RHSA-2002-293: Updated Fetchmail packages fix security vulnerability
- RHSA-2002-294: fetchmail security update
- RHSA-2003-155: Updated Fetchmail packages fix security vulnerabilities
- SUSE-SA:2003:001: fetchmail: remote compromise
Platforms Affected:
- Conectiva Linux 6.0
- Conectiva Linux 7.0
- Conectiva Linux 8.0
- Debian Debian Linux 2.2
- Debian Debian Linux 3.0
- EngardeLinux Secure Linux
- EngardeLinux Secure Professional
- Eric S. Raymond Fetchmail 6.1.3
- Gentoo Linux
- Immunix Immunix OS 7+-beta
- MandrakeSoft Mandrake Linux 7.2
- MandrakeSoft Mandrake Linux 8.0
- MandrakeSoft Mandrake Linux 8.0 PPC
- MandrakeSoft Mandrake Linux 8.1 IA64
- MandrakeSoft Mandrake Linux 8.1
- MandrakeSoft Mandrake Linux 8.2
- MandrakeSoft Mandrake Linux 8.2 PPC
- MandrakeSoft Mandrake Linux 9.0
- MandrakeSoft Mandrake Single Network Firewall 7.2
- Novell SuSE Linux Enterprise Server 7.0
- Novell UnitedLinux 1.0
- OpenPKG OpenPKG 1.0
- OpenPKG OpenPKG 1.1
- OpenPKG OpenPKG CURRENT
- RedHat Enterprise Linux 2.1 AS
- RedHat Linux 6.2
- RedHat Linux 7
- RedHat Linux 7.1
- RedHat Linux 7.1 for iSeries
- RedHat Linux 7.1 for pSeries
- RedHat Linux 7.2
- RedHat Linux 7.3
- RedHat Linux 8.0
- RedHat Linux Advanced Workstation 2.1 Itanium
- SCO Caldera OpenLinux Server 3.1
- SCO Caldera OpenLinux Server 3.1.1
- SCO Caldera OpenLinux Workstation 3.1
- SCO Caldera OpenLinux Workstation 3.1.1
- SuSE Linux Enterprise Server 8
- SuSE SuSE eMail Server 3.1
- SuSE SuSE eMail Server III
- SUSE SuSE Linux 7.1
- SUSE SuSE Linux 7.2
- SUSE SuSE Linux 7.3
- SUSE SuSE Linux 8.0
- SUSE SuSE Linux 8.1
- SUSE SuSE Linux 9.0
- SuSE SuSE Linux Connectivity Server
- SuSE SuSE Linux Firewall
- SuSE SuSE Linux Office Server
Reported:
Dec 13, 2002
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net