bugzillaat_private writes: > Updated fetchmail packages are available for Red Hat Linux 6.2, 7, 7.1, > 7.2, and 7.3 which close a remotely-exploitable vulnerability in unpatched > versions of fetchmail prior to 5.9.10. It appears that this vulnerability is caused by some alloca() implementations which do not return zero if the caller requests more memory than which is available. Red Hat's patch does not address the root of the problem by fixing alloca() (a problem which might be of more generic nature and could well be present in other software as well), but it bounds the requested memory by something which appears to be a rather arbitrary constant. -- Florian Weimer Weimerat_private-Stuttgart.DE University of Stuttgart http://CERT.Uni-Stuttgart.DE/people/fw/ RUS-CERT +49-711-685-5973/fax +49-711-685-5898
This archive was generated by hypermail 2b30 : Fri May 31 2002 - 10:09:34 PDT