To: bugtraqat_private announceat_private security-alertsat_private ______________________________________________________________________________ Caldera International, Inc. Security Advisory Subject: Linux: fetchmail imap message count vulnerability Advisory number: CSSA-2002-027.0 Issue date: 2002 June 17 Cross reference: ______________________________________________________________________________ 1. Problem Description The fetchmail email client does not properly limit the maximum number of messages available. This allows a remote IMAP server to overwrite memory via a message count that exceeds the boundaries of an array. 2. Vulnerable Supported Versions System Package ---------------------------------------------------------------------- OpenLinux 3.1.1 Server prior to fetchmail-5.8.17-3.i386.rpm prior to fetchmailconf-5.8.17-3.i386.rpm OpenLinux 3.1.1 Workstation prior to fetchmail-5.8.17-3.i386.rpm prior to fetchmailconf-5.8.17-3.i386.rpm OpenLinux 3.1 Server prior to fetchmail-5.8.17-3.i386.rpm prior to fetchmailconf-5.8.17-3.i386.rpm OpenLinux 3.1 Workstation prior to fetchmail-5.8.17-3.i386.rpm prior to fetchmailconf-5.8.17-3.i386.rpm 3. Solution The proper solution is to install the latest packages. 4. OpenLinux 3.1.1 Server 4.1 Package Location ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/RPMS 4.2 Packages fe2a12a46105337465eaade27dcdfd19 fetchmail-5.8.17-3.i386.rpm 5ee700b144f9888d71760c68af7bdd10 fetchmailconf-5.8.17-3.i386.rpm 4.3 Installation rpm -Fvh fetchmail-5.8.17-3.i386.rpm rpm -Fvh fetchmailconf-5.8.17-3.i386.rpm 4.4 Source Package Location ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/SRPMS 4.5 Source Packages d0baecda18a7f2602fe2b1634463addb fetchmail-5.8.17-3.src.rpm 5. OpenLinux 3.1.1 Workstation 5.1 Package Location ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/current/RPMS 5.2 Packages e53982b3b4bd650aeca7342b155fd150 fetchmail-5.8.17-3.i386.rpm 66c50c0b2a80a01e5a6b80ee10b999cb fetchmailconf-5.8.17-3.i386.rpm 5.3 Installation rpm -Fvh fetchmail-5.8.17-3.i386.rpm rpm -Fvh fetchmailconf-5.8.17-3.i386.rpm 5.4 Source Package Location ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/current/SRPMS 5.5 Source Packages 282f59e2897e214270789b9bd12b1ebe fetchmail-5.8.17-3.src.rpm 6. OpenLinux 3.1 Server 6.1 Package Location ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/RPMS 6.2 Packages 4e1d00de455d83703ef352b6954a26b5 fetchmail-5.8.17-3.i386.rpm 0d86128975e46e9e739728157e4c8eef fetchmailconf-5.8.17-3.i386.rpm 6.3 Installation rpm -Fvh fetchmail-5.8.17-3.i386.rpm rpm -Fvh fetchmailconf-5.8.17-3.i386.rpm 6.4 Source Package Location ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/SRPMS 6.5 Source Packages 94f1a2221da6db44c31f5562a8935b83 fetchmail-5.8.17-3.src.rpm 7. OpenLinux 3.1 Workstation 7.1 Package Location ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/current/RPMS 7.2 Packages 7b6142d18892c4a4afe6a956f3a8ae51 fetchmail-5.8.17-3.i386.rpm 6ca58cc1462555b90ff4b5c3a395adb8 fetchmailconf-5.8.17-3.i386.rpm 7.3 Installation rpm -Fvh fetchmail-5.8.17-3.i386.rpm rpm -Fvh fetchmailconf-5.8.17-3.i386.rpm 7.4 Source Package Location ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/current/SRPMS 7.5 Source Packages 296fb5b80dbd73aefffad24b3998f33c fetchmail-5.8.17-3.src.rpm 8. References Specific references for this advisory: http://tuxedo.org/~esr/fetchmail/NEWS http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0146 Caldera security resources: http://www.caldera.com/support/security/index.html This security fix closes Caldera incidents sr865008, fz521068, erg712057. 9. Disclaimer Caldera International, Inc. is not responsible for the misuse of any of the information we provide on this website and/or through our security advisories. Our advisories are a service to our customers intended to promote secure installation and use of Caldera products. ______________________________________________________________________________
This archive was generated by hypermail 2b30 : Mon Jun 17 2002 - 18:13:10 PDT