[SM-Security] [SMGLSA-2008-03] Multiple vulnerabilites that can lead to crashes
samuel at dragonboricua.net
Wed Jul 30 00:50:42 EDT 2008
Crashes related to local fetchmail-generated warning message is rejected
and when with large log messages when running fetchmail in verbose mode.
fetchmail is a software package to retrieve mail from remote POP2, POP3,
IMAP, ETRN or ODMR servers and forward it to local SMTP, LMTP servers or
message delivery agents.
fetchmail ships with a graphical, Python/Tkinter based configuration
utility named "fetchmailconf" to help the user create configuration (run
control) files for fetchmail.
fetchmail will generate warning messages in certain circumstances and
send them to the local postmaster or the user starting it. Such warning
messages can be generated, for instance, if logging into an upstream
server fails repeatedly or if messages beyond the size limit (if
configured, default: no limit) are left on the server.
If this warning message is then refused by the SMTP listener that
fetchmail is forwarding the message to, fetchmail attempts to
dereference a NULL pointer when trying to find out if it should allow a
bounce message to be sent.
This causes fetchmail to crash and not collect further messages until it
Risk assessment: low. In default configuration, fetchmail will talk
through the loopback interface, that means to the SMTP server on the same
computer as it is running on. Otherwise, it will commonly be configured
to talk to trusted SMTP servers, so a compromise or misconfiguration of
a trusted or the same computer is required to exploit this problem -
which usually opens up much easier ways of denying service, or worse.
Gunter Nau reported fetchmail crashing on some messages; further
debugging by Petr Uzel and Petr Cerny at Novell/SUSE Czech Republic
dug up that this happened when fetchmail was trying to print, in -v -v
verbose level, headers exceeding 2048 bytes. In this situation,
fetchmail would resize the buffer and fill in further parts of the
message, but forget to reinitialize its va_list typed source pointer,
thus reading data from a garbage address found on the stack at
addresses above the function arguments the caller passed in; usually
that would be the caller's stack frame.
It is unknown whether code can be injected remotely, but given that
the segmentation fault is caused by read accesses, the relevant data
is not under the remote attacker's control and no buffer overrun
situation is present that would allow altering program /flow/, it is
deemed rather unlikely that code can be injected.
Note that the required -vv configuration at hand is both non-default
and also not common in automated (cron job) setups, but usually used
in manual debugging, so not many systems would be affected by the
problem. Nonetheless, in vulnerable configurations, it is remotely
exploitable to effect a denial of service attack.
These vulnerabilities were reported for all versions of fetchmail prior to
(and including) 6.3.8. fetchmail in all grimoires is affected by these
fetchmail has been updated in test, and will soon be in the stable grimoire.
Be sure to read both security advisories to make sure you take all
necessary steps and get informed more in-depth about the vulnerabilities.
All fetchmail users should upgrade to the latest available version:
# scribe update
# cast -c fetchmail
If you maintain your own installation of fetchmail ouside of sorcery, there are
patches available from upstream in the security advisories.
Elisamuel Resto <samuel at dragonboricua.net>
Source Mage General Guru / http://sourcemage.org
GPG ID: 18615F19/1024D / http://simplysam.us
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 197 bytes
Desc: not available
Url : http://lists.ibiblio.org/pipermail/sm-security/attachments/20080730/47015a68/attachment.bin
More information about the SM-Security