Security Update: [CSSA-2002-027.0] Linux: fetchmail imap message count vulnerability
Date: Mon, 17 Jun 2002 15:01:50 -0700
From: [email protected]
To: [email protected], [email protected],
Subject: Security Update: [CSSA-2002-027.0] Linux: fetchmail imap message count vulnerability
--T4sUOijqQbZv57TR
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
To: [email protected] [email protected] [email protected]
______________________________________________________________________________
Caldera International, Inc. Security Advisory
Subject: Linux: fetchmail imap message count vulnerability
Advisory number: CSSA-2002-027.0
Issue date: 2002 June 17
Cross reference:
______________________________________________________________________________
1. Problem Description
The fetchmail email client does not properly limit the maximum
number of messages available. This allows a remote IMAP server to
overwrite memory via a message count that exceeds the boundaries
of an array.
2. Vulnerable Supported Versions
System Package
----------------------------------------------------------------------
OpenLinux 3.1.1 Server prior to fetchmail-5.8.17-3.i386.rpm
prior to fetchmailconf-5.8.17-3.i386.rpm
OpenLinux 3.1.1 Workstation prior to fetchmail-5.8.17-3.i386.rpm
prior to fetchmailconf-5.8.17-3.i386.rpm
OpenLinux 3.1 Server prior to fetchmail-5.8.17-3.i386.rpm
prior to fetchmailconf-5.8.17-3.i386.rpm
OpenLinux 3.1 Workstation prior to fetchmail-5.8.17-3.i386.rpm
prior to fetchmailconf-5.8.17-3.i386.rpm
3. Solution
The proper solution is to install the latest packages.
4. OpenLinux 3.1.1 Server
4.1 Package Location
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/RPMS
4.2 Packages
fe2a12a46105337465eaade27dcdfd19 fetchmail-5.8.17-3.i386.rpm
5ee700b144f9888d71760c68af7bdd10 fetchmailconf-5.8.17-3.i386.rpm
4.3 Installation
rpm -Fvh fetchmail-5.8.17-3.i386.rpm
rpm -Fvh fetchmailconf-5.8.17-3.i386.rpm
4.4 Source Package Location
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/SRPMS
4.5 Source Packages
d0baecda18a7f2602fe2b1634463addb fetchmail-5.8.17-3.src.rpm
5. OpenLinux 3.1.1 Workstation
5.1 Package Location
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/current/RPMS
5.2 Packages
e53982b3b4bd650aeca7342b155fd150 fetchmail-5.8.17-3.i386.rpm
66c50c0b2a80a01e5a6b80ee10b999cb fetchmailconf-5.8.17-3.i386.rpm
5.3 Installation
rpm -Fvh fetchmail-5.8.17-3.i386.rpm
rpm -Fvh fetchmailconf-5.8.17-3.i386.rpm
5.4 Source Package Location
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/current/SRPMS
5.5 Source Packages
282f59e2897e214270789b9bd12b1ebe fetchmail-5.8.17-3.src.rpm
6. OpenLinux 3.1 Server
6.1 Package Location
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/RPMS
6.2 Packages
4e1d00de455d83703ef352b6954a26b5 fetchmail-5.8.17-3.i386.rpm
0d86128975e46e9e739728157e4c8eef fetchmailconf-5.8.17-3.i386.rpm
6.3 Installation
rpm -Fvh fetchmail-5.8.17-3.i386.rpm
rpm -Fvh fetchmailconf-5.8.17-3.i386.rpm
6.4 Source Package Location
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/SRPMS
6.5 Source Packages
94f1a2221da6db44c31f5562a8935b83 fetchmail-5.8.17-3.src.rpm
7. OpenLinux 3.1 Workstation
7.1 Package Location
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/current/RPMS
7.2 Packages
7b6142d18892c4a4afe6a956f3a8ae51 fetchmail-5.8.17-3.i386.rpm
6ca58cc1462555b90ff4b5c3a395adb8 fetchmailconf-5.8.17-3.i386.rpm
7.3 Installation
rpm -Fvh fetchmail-5.8.17-3.i386.rpm
rpm -Fvh fetchmailconf-5.8.17-3.i386.rpm
7.4 Source Package Location
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/current/SRPMS
7.5 Source Packages
296fb5b80dbd73aefffad24b3998f33c fetchmail-5.8.17-3.src.rpm
8. References
Specific references for this advisory:
http://tuxedo.org/~esr/fetchmail/NEWS
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0146
Caldera security resources:
http://www.caldera.com/support/security/index.html
This security fix closes Caldera incidents sr865008, fz521068,
erg712057.
9. Disclaimer
Caldera International, Inc. is not responsible for the misuse
of any of the information we provide on this website and/or
through our security advisories. Our advisories are a service
to our customers intended to promote secure installation and
use of Caldera products.
______________________________________________________________________________
--T4sUOijqQbZv57TR
Content-Type: application/pgp-signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (SCO_SV)
Comment: For info see http://www.gnupg.org
iEYEARECAAYFAj0OXE0ACgkQbluZssSXDTFtDwCdHQT78/fucbTRsQKByxTRd/YE
l04An0pk+kqhmOiJHLeDwPbOBFotgu4R
=Awds
-----END PGP SIGNATURE-----
--T4sUOijqQbZv57TR--
