CVE-2002-1365
CVSS7.5
发布时间 :2002-12-23 00:00:00
修订时间 :2016-10-17 22:26:18
NMCOS    

[原文]Heap-based buffer overflow in Fetchmail 6.1.3 and earlier does not account for the "@" character when determining buffer lengths for local addresses, which allows remote attackers to execute arbitrary code via a header with a large number of local addresses.


[CNNVD]Eric S. Raymond Fetchmail恶意邮件头造成堆破坏漏洞(CNNVD-200212-039)

        
        Fetchmail是一款由Eric S. Raymond维护的免费开放源代码邮件过滤系统。
        Fetchmail在执行reply-hack操作时没有为搜索到的地址分配足够的空间,远程攻击者可以利用这个漏洞提交包含恶意头信息的邮件给目标用户,造成基于堆的破坏。
        当Fetchmail接收到EMAIL时会执行reply-hack操作,这个操作将对邮件头中包含的地址进行搜索,搜索是否有本地地址(不包含@domain)。当此地址找到时,Fetchmail会追加@和邮件服务器主机名。在分配这些地址的空间时,只对主机名数值进行了计算,而没有处理@符号,因此邮件头中包含超长本地地址可能导致发生基于单字节的溢出,精心构建提交数据可能以本地进程权限在系统上执行任意指令。
        

- CVSS (基础分值)

CVSS分值: 7.5 [严重(HIGH)]
机密性影响: [--]
完整性影响: [--]
可用性影响: [--]
攻击复杂度: [--]
攻击向量: [--]
身份认证: [--]

- CWE (弱点类目)

CWE-119 [内存缓冲区边界内操作的限制不恰当]

- CPE (受影响的平台与产品)

cpe:/a:fetchmail:fetchmail:5.8.6Fetchmail 5.8.6
cpe:/a:fetchmail:fetchmail:5.8.5Fetchmail 5.8.5
cpe:/a:fetchmail:fetchmail:5.8.4Fetchmail 5.8.4
cpe:/a:fetchmail:fetchmail:5.8.3Fetchmail 5.8.3
cpe:/a:fetchmail:fetchmail:5.8.11Fetchmail 5.8.11
cpe:/a:fetchmail:fetchmail:5.8.2Fetchmail 5.8.2
cpe:/a:fetchmail:fetchmail:5.2.8Fetchmail 5.2.8
cpe:/a:fetchmail:fetchmail:5.8.1Fetchmail 5.8.1
cpe:/a:fetchmail:fetchmail:5.4.5Fetchmail 5.4.5
cpe:/a:fetchmail:fetchmail:5.2.7Fetchmail 5.2.7
cpe:/a:fetchmail:fetchmail:5.4.4Fetchmail 5.4.4
cpe:/a:fetchmail:fetchmail:5.0.8Fetchmail 5.0.8
cpe:/a:fetchmail:fetchmail:5.4.3Fetchmail 5.4.3
cpe:/a:fetchmail:fetchmail:5.0.7Fetchmail 5.0.7
cpe:/a:fetchmail:fetchmail:4.6.7Fetchmail 4.6.7
cpe:/a:fetchmail:fetchmail:4.6.6Fetchmail 4.6.6
cpe:/a:fetchmail:fetchmail:4.6.9Fetchmail 4.6.9
cpe:/a:fetchmail:fetchmail:4.6.8Fetchmail 4.6.8
cpe:/a:fetchmail:fetchmail:5.1.0Fetchmail 5.1.0
cpe:/a:fetchmail:fetchmail:4.6.3Fetchmail 4.6.3
cpe:/a:fetchmail:fetchmail:4.6.2Fetchmail 4.6.2
cpe:/a:fetchmail:fetchmail:4.6.5Fetchmail 4.6.5
cpe:/a:fetchmail:fetchmail:4.6.4Fetchmail 4.6.4
cpe:/a:fetchmail:fetchmail:6.1.0Fetchmail 6.1.0
cpe:/a:fetchmail:fetchmail:5.8Fetchmail 5.8
cpe:/a:fetchmail:fetchmail:5.6.0Fetchmail 5.6.0
cpe:/a:fetchmail:fetchmail:5.2.4Fetchmail 5.2.4
cpe:/a:fetchmail:fetchmail:5.0.6Fetchmail 5.0.6
cpe:/a:fetchmail:fetchmail:5.2.3Fetchmail 5.2.3
cpe:/a:fetchmail:fetchmail:5.0.5Fetchmail 5.0.5
cpe:/a:fetchmail:fetchmail:5.0.4Fetchmail 5.0.4
cpe:/a:fetchmail:fetchmail:5.4.0Fetchmail 5.4.0
cpe:/a:fetchmail:fetchmail:5.2.1Fetchmail 5.2.1
cpe:/a:fetchmail:fetchmail:5.0.3Fetchmail 5.0.3
cpe:/a:fetchmail:fetchmail:4.6.1Fetchmail 4.6.1
cpe:/a:fetchmail:fetchmail:4.6.0Fetchmail 4.6.0
cpe:/a:fetchmail:fetchmail:5.9.5Fetchmail 5.9.5
cpe:/a:fetchmail:fetchmail:5.9.4Fetchmail 5.9.4
cpe:/a:fetchmail:fetchmail:5.5.6Fetchmail 5.5.6
cpe:/a:fetchmail:fetchmail:5.3.8Fetchmail 5.3.8
cpe:/a:fetchmail:fetchmail:5.7.4Fetchmail 5.7.4
cpe:/a:fetchmail:fetchmail:5.9.8Fetchmail 5.9.8
cpe:/a:fetchmail:fetchmail:5.9.13Fetchmail 5.9.13
cpe:/a:fetchmail:fetchmail:5.5.5Fetchmail 5.5.5
cpe:/a:fetchmail:fetchmail:5.7.2Fetchmail 5.7.2
cpe:/a:fetchmail:fetchmail:5.9.0Fetchmail 5.9.0
cpe:/a:fetchmail:fetchmail:5.5.3Fetchmail 5.5.3
cpe:/a:fetchmail:fetchmail:5.7.0Fetchmail 5.7.0
cpe:/a:fetchmail:fetchmail:5.5.2Fetchmail 5.5.2
cpe:/a:fetchmail:fetchmail:4.7.6Fetchmail 4.7.6
cpe:/a:fetchmail:fetchmail:4.5.8Fetchmail 4.5.8
cpe:/a:fetchmail:fetchmail:4.7.5Fetchmail 4.7.5
cpe:/a:fetchmail:fetchmail:4.5.7Fetchmail 4.5.7
cpe:/a:fetchmail:fetchmail:4.7.7Fetchmail 4.7.7
cpe:/a:fetchmail:fetchmail:5.2.0Fetchmail 5.2.0
cpe:/a:fetchmail:fetchmail:5.0.2Fetchmail 5.0.2
cpe:/a:fetchmail:fetchmail:5.0.1Fetchmail 5.0.1
cpe:/a:fetchmail:fetchmail:5.0.0Fetchmail 5.0.0
cpe:/a:fetchmail:fetchmail:4.7.2Fetchmail 4.7.2
cpe:/a:fetchmail:fetchmail:4.5.4Fetchmail 4.5.4
cpe:/a:fetchmail:fetchmail:4.7.1Fetchmail 4.7.1
cpe:/a:fetchmail:fetchmail:4.5.3Fetchmail 4.5.3
cpe:/a:fetchmail:fetchmail:4.7.4Fetchmail 4.7.4
cpe:/a:fetchmail:fetchmail:4.5.6Fetchmail 4.5.6
cpe:/a:fetchmail:fetchmail:4.7.3Fetchmail 4.7.3
cpe:/a:fetchmail:fetchmail:4.5.5Fetchmail 4.5.5
cpe:/a:fetchmail:fetchmail:6.1.3Fetchmail 6.1.3
cpe:/a:fetchmail:fetchmail:5.8.17Fetchmail 5.8.17
cpe:/a:fetchmail:fetchmail:6.0.0Fetchmail 6.0.0
cpe:/a:fetchmail:fetchmail:5.3.3Fetchmail 5.3.3
cpe:/a:fetchmail:fetchmail:5.9.10Fetchmail 5.9.10
cpe:/a:fetchmail:fetchmail:5.5.0Fetchmail 5.5.0
cpe:/a:fetchmail:fetchmail:5.1.4Fetchmail 5.1.4
cpe:/a:fetchmail:fetchmail:5.9.11Fetchmail 5.9.11
cpe:/a:fetchmail:fetchmail:5.3.1Fetchmail 5.3.1
cpe:/a:fetchmail:fetchmail:5.3.0Fetchmail 5.3.0
cpe:/a:fetchmail:fetchmail:5.8.13Fetchmail 5.8.13
cpe:/a:fetchmail:fetchmail:5.8.14Fetchmail 5.8.14
cpe:/a:fetchmail:fetchmail:4.7.0Fetchmail 4.7.0
cpe:/a:fetchmail:fetchmail:4.5.2Fetchmail 4.5.2
cpe:/a:fetchmail:fetchmail:4.5.1Fetchmail 4.5.1

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1365
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2002-1365
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200212-039
(官方数据源) CNNVD

- 其它链接及资源

ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2003-001.0.txt
(UNKNOWN)  CALDERA  CSSA-2003-001.0
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000554
(UNKNOWN)  CONECTIVA  CLA-2002:554
http://marc.info/?l=bugtraq&m=103979751818638&w=2
(UNKNOWN)  BUGTRAQ  20021213 Advisory 05/2002: Another Fetchmail Remote Vulnerability
http://marc.info/?l=bugtraq&m=104004858802000&w=2
(UNKNOWN)  BUGTRAQ  20021215 GLSA: fetchmail
http://security.e-matters.de/advisories/052002.html
(UNKNOWN)  MISC  http://security.e-matters.de/advisories/052002.html
http://www.debian.org/security/2002/dsa-216
(UNKNOWN)  DEBIAN  DSA-216
http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:011
(UNKNOWN)  MANDRAKE  MDKSA-2003:011
http://www.redhat.com/support/errata/RHSA-2002-293.html
(VENDOR_ADVISORY)  REDHAT  RHSA-2002:293
http://www.redhat.com/support/errata/RHSA-2002-294.html
(UNKNOWN)  REDHAT  RHSA-2002:294
http://www.redhat.com/support/errata/RHSA-2003-155.html
(UNKNOWN)  REDHAT  RHSA-2003:155
http://www.securityfocus.com/bid/6390
(UNKNOWN)  BID  6390
http://xforce.iss.net/xforce/xfdb/10839
(UNKNOWN)  XF  fetchmail-address-header-bo(10839)

- 漏洞信息

Eric S. Raymond Fetchmail恶意邮件头造成堆破坏漏洞
高危 边界条件错误
2002-12-23 00:00:00 2005-10-12 00:00:00
远程  
        
        Fetchmail是一款由Eric S. Raymond维护的免费开放源代码邮件过滤系统。
        Fetchmail在执行reply-hack操作时没有为搜索到的地址分配足够的空间,远程攻击者可以利用这个漏洞提交包含恶意头信息的邮件给目标用户,造成基于堆的破坏。
        当Fetchmail接收到EMAIL时会执行reply-hack操作,这个操作将对邮件头中包含的地址进行搜索,搜索是否有本地地址(不包含@domain)。当此地址找到时,Fetchmail会追加@和邮件服务器主机名。在分配这些地址的空间时,只对主机名数值进行了计算,而没有处理@符号,因此邮件头中包含超长本地地址可能导致发生基于单字节的溢出,精心构建提交数据可能以本地进程权限在系统上执行任意指令。
        

- 公告与补丁

        厂商补丁:
        Conectiva
        ---------
        Conectiva已经为此发布了一个安全公告(CLA-2002:554)以及相应补丁:
        CLA-2002:554:fetchmail
        链接:
        http://distro.conectiva.com/atualizacoes/?id=a&anuncio=000554

        补丁下载:
        Conectiva Upgrade fetchmail-5.9.12-1U60_4cl.i386.rpm
        ftp://atualizacoes.conectiva.com.br/6.0/RPMS/fetchmail-5.9.12-1U60_4cl.i386.rpm
        Conectiva Upgrade fetchmailconf-5.9.12-1U60_4cl.i386.rpm
        ftp://atualizacoes.conectiva.com.br/6.0/RPMS/fetchmailconf-5.9.12-1U60_4cl.i386.rpm
        Conectiva Upgrade fetchmail-doc-5.9.12-1U60_4cl.i386.rpm
        ftp://atualizacoes.conectiva.com.br/6.0/RPMS/fetchmail-doc-5.9.12-1U60_4cl.i386.rpm
        Conectiva Upgrade fetchmail-5.9.12-1U70_4cl.i386.rpm
        ftp://atualizacoes.conectiva.com.br/7.0/RPMS/fetchmail-5.9.12-1U70_4cl.i386.rpm
        Conectiva Upgrade fetchmailconf-5.9.12-1U70_4cl.i386.rpm
        ftp://atualizacoes.conectiva.com.br/7.0/RPMS/fetchmailconf-5.9.12-1U70_4cl.i386.rpm
        Conectiva Upgrade fetchmail-doc-5.9.12-1U70_4cl.i386.rpm
        ftp://atualizacoes.conectiva.com.br/7.0/RPMS/fetchmail-doc-5.9.12-1U70_4cl.i386.rpm
        Conectiva Upgrade fetchmail-5.9.12-1U80_3cl.i386.rpm
        ftp://atualizacoes.conectiva.com.br/8/RPMS/fetchmail-5.9.12-1U80_3cl.i386.rpm
        Conectiva Upgrade fetchmailconf-5.9.12-1U80_3cl.i386.rpm
        ftp://atualizacoes.conectiva.com.br/8/RPMS/fetchmailconf-5.9.12-1U80_3cl.i386.rpm
        Conectiva Upgrade fetchmail-doc-5.9.12-1U80_3cl.i386.rpm
        ftp://atualizacoes.conectiva.com.br/8/RPMS/fetchmail-doc-5.9.12-1U80_3cl.i386.rpm
        Eric Raymond
        ------------
        目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载:
        Eric Raymond Upgrade fetchmail-6.2.0.tar.gz
        
        http://www.tuxedo.org/~esr/fetchmail/fetchmail-6.2.0.tar.gz

        RedHat
        ------
        RedHat已经为此发布了一个安全公告(RHSA-2002:293-09)以及相应补丁:
        RHSA-2002:293-09:Updated Fetchmail packages fix security vulnerability
        链接:https://www.redhat.com/support/errata/RHSA-2002-293.html
        补丁下载:
        RedHat RPM fetchmail-5.9.0-21.8.0.i386.rpm
        ftp://updates.redhat.com/8.0/en/os/i386/fetchmail-5.9.0-21.8.0.i386.rpm
        RedHat RPM fetchmailconf-5.9.0-21.7.3.i386.rpm
        ftp://updates.redhat.com/7.3/en/os/i386/fetchmailconf-5.9.0-21.7.3.i386.rpm
        RedHat RPM fetchmail-5.9.0-21.7.3.i386.rpm
        ftp://updates.redhat.com/7.3/en/os/i386/fetchmail-5.9.0-21.7.3.i386.rpm
        RedHat RPM fetchmailconf-5.9.0-21.7.3.ia64.rpm
        ftp://updates.redhat.com/7.2/en/os/ia64/fetchmailconf-5.9.0-21.7.3.ia64.rpm
        RedHat RPM fetchmail-5.9.0-21.7.3.ia64.rpm
        ftp://updates.redhat.com/7.2/en/os/ia64/fetchmail-5.9.0-21.7.3.ia64.rpm
        RedHat RPM fetchmailconf-5.9.0-21.7.3.i386.rpm
        ftp://updates.redhat.com/7.2/en/os/i386/fetchmailconf-5.9.0-21.7.3.i386.rpm
        RedHat RPM fetchmail-5.9.0-21.7.3.i386.rpm
        ftp://updates.redhat.com/7.2/en/os/i386/fetchmail-5.9.0-21.7.3.i386.rpm
        RedHat RPM fetchmailconf-5.9.0-21.7.1.i386.rpm
        ftp://updates.redhat.com/7.1/en/os/i386/fetchmailconf-5.9.0-21.7.1.i386.rpm
        RedHat RPM fetchmail-5.9.0-21.7.1.i386.rpm
        ftp://updates.redhat.com/7.1/en/os/i386/fetchmail-5.9.0-21.7.1.i386.rpm
        RedHat RPM fetchmailconf-5.9.0-21.7.1.i386.rpm
        ftp://updates.redhat.com/7.0/en/os/i386/fetchmailconf-5.9.0-21.7.1.i386.rpm
        RedHat RPM fetchmail-5.9.0-21.7.1.i386.rpm
        ftp://updates.redhat.com/7.0/en/os/i386/fetchmail-5.9.0-21.7.1.i386.rpm
        RedHat RPM fetchmailconf-5.9.0-21.6.2.i386.rpm
        ftp://updates.redhat.com/6.2/en/os/i386/fetchmailconf-5.9.0-21.6.2.i386.rpm
        RedHat RPM fetchmail-5.9.0-21.6.2.i386.rpm
        ftp://updates.redhat.com/6.2/en/os/i386/fetchmail-5.9.0-21.6.2.i386.rpm

- 漏洞信息

4594
Fetchmail @ Character Local Address Saturation Overflow
Remote / Network Access Input Manipulation
Loss of Integrity Upgrade
Vendor Verified

- 漏洞描述

- 时间线

2003-01-09 Unknow
Unknow Unknow

- 解决方案

Upgrade to version 6.2.0 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

- 相关参考

- 漏洞作者

Unknown or Incomplete

- 漏洞信息

Eric S. Raymond Fetchmail Heap Corruption Vulnerability
Boundary Condition Error 6390
Yes No
2002-12-13 12:00:00 2009-07-11 07:16:00
Discovery of this vulnerability credited to Stefan Esser <s.esser@e-matters.de>.

- 受影响的程序版本

Eric Raymond Fetchmail 6.1.3
+ OpenPKG OpenPKG Current
Eric Raymond Fetchmail 6.1 .0
+ EnGarde Secure Linux 1.0.1
+ MandrakeSoft Corporate Server 2.1 x86_64
+ MandrakeSoft Corporate Server 2.1
+ MandrakeSoft Single Network Firewall 7.2
+ Mandriva Linux Mandrake 9.0
+ Mandriva Linux Mandrake 8.2
+ Mandriva Linux Mandrake 8.1
+ Mandriva Linux Mandrake 8.0
+ Mandriva Linux Mandrake 7.2
Eric Raymond Fetchmail 6.0 .0
Eric Raymond Fetchmail 5.9.14
+ Gentoo Linux 1.4 _rc1
+ Gentoo Linux 1.2
Eric Raymond Fetchmail 5.9.13
+ OpenPKG OpenPKG 1.1
+ S.u.S.E. Linux 8.1
Eric Raymond Fetchmail 5.9.12
+ Conectiva Linux 8.0
+ Conectiva Linux 7.0
+ Conectiva Linux 6.0
Eric Raymond Fetchmail 5.9.11
+ Debian Linux 3.0 sparc
+ Debian Linux 3.0 s/390
+ Debian Linux 3.0 ppc
+ Debian Linux 3.0 mipsel
+ Debian Linux 3.0 mips
+ Debian Linux 3.0 m68k
+ Debian Linux 3.0 ia-64
+ Debian Linux 3.0 ia-32
+ Debian Linux 3.0 hppa
+ Debian Linux 3.0 arm
+ Debian Linux 3.0 alpha
Eric Raymond Fetchmail 5.9.10
Eric Raymond Fetchmail 5.9.9
+ HP Secure OS software for Linux 1.0
Eric Raymond Fetchmail 5.9.8
Eric Raymond Fetchmail 5.9.7
Eric Raymond Fetchmail 5.9.6
Eric Raymond Fetchmail 5.9.5
+ OpenPKG OpenPKG 1.0
Eric Raymond Fetchmail 5.9.4
Eric Raymond Fetchmail 5.9.3
Eric Raymond Fetchmail 5.9.2
Eric Raymond Fetchmail 5.9.1
Eric Raymond Fetchmail 5.9 .0
+ Immunix Immunix OS 7+
+ Red Hat Linux 6.2
+ RedHat Linux 8.0 i386
+ RedHat Linux 8.0
+ RedHat Linux 7.3 i386
+ RedHat Linux 7.3
+ RedHat Linux 7.2 ia64
+ RedHat Linux 7.2 i386
+ RedHat Linux 7.2 alpha
+ RedHat Linux 7.2
+ RedHat Linux 7.1 ia64
+ RedHat Linux 7.1 i386
+ RedHat Linux 7.1 alpha
+ RedHat Linux 7.1
+ RedHat Linux 7.0 sparc
+ RedHat Linux 7.0 i386
+ RedHat Linux 7.0 alpha
+ RedHat Linux 7.0
+ RedHat Linux 6.2 sparc
+ RedHat Linux 6.2 i386
+ RedHat Linux 6.2 alpha
+ S.u.S.E. Linux 7.3 sparc
+ S.u.S.E. Linux 7.3 ppc
+ S.u.S.E. Linux 7.3 i386
+ S.u.S.E. Linux 7.3
+ Sun Linux 5.0
Eric Raymond Fetchmail 5.8.17
+ Caldera OpenLinux Server 3.1.1
+ Caldera OpenLinux Server 3.1
+ Caldera OpenLinux Workstation 3.1.1
+ Caldera OpenLinux Workstation 3.1
Eric Raymond Fetchmail 5.8.16
Eric Raymond Fetchmail 5.8.15
Eric Raymond Fetchmail 5.8.14
Eric Raymond Fetchmail 5.8.13
Eric Raymond Fetchmail 5.8.12
Eric Raymond Fetchmail 5.8.11
Eric Raymond Fetchmail 5.8.10
Eric Raymond Fetchmail 5.8.9
Eric Raymond Fetchmail 5.8.8
Eric Raymond Fetchmail 5.8.7
Eric Raymond Fetchmail 5.8.6
- Apple Mac OS X 10.1
Eric Raymond Fetchmail 5.8.5
Eric Raymond Fetchmail 5.8.4
Eric Raymond Fetchmail 5.8.3
Eric Raymond Fetchmail 5.8.2
Eric Raymond Fetchmail 5.8.1
Eric Raymond Fetchmail 5.8 .0
+ S.u.S.E. Linux 7.2
Eric Raymond Fetchmail 5.7
Eric Raymond Fetchmail 5.6.5
+ S.u.S.E. Linux 7.1 x86
+ S.u.S.E. Linux 7.1 sparc
+ S.u.S.E. Linux 7.1 ppc
+ S.u.S.E. Linux 7.1 alpha
+ S.u.S.E. Linux 7.1
Eric Raymond Fetchmail 5.6
Eric Raymond Fetchmail 5.5
+ Cobalt Qube 3.0
- Immunix Immunix OS 7.0 beta
- Immunix Immunix OS 7.0
Eric Raymond Fetchmail 5.4 .0
+ Caldera OpenLinux Server 3.1.1
+ Caldera OpenLinux Server 3.1
+ Caldera OpenLinux Workstation 3.1.1
+ Caldera OpenLinux Workstation 3.1
+ EnGarde Secure Linux 1.0.1
- Guardian Digital Engarde Secure Linux 1.0.1
Eric Raymond Fetchmail 5.3.3
+ Debian Linux 2.2 sparc
+ Debian Linux 2.2 powerpc
+ Debian Linux 2.2 IA-32
+ Debian Linux 2.2 arm
+ Debian Linux 2.2 alpha
+ Debian Linux 2.2 68k
Eric Raymond Fetchmail 6.2 .0

- 不受影响的程序版本

Eric Raymond Fetchmail 6.2 .0

- 漏洞讨论

A remotely exploitable heap overflow vulnerability has been reported for Fetchmail 6.1.3 and earlier. The vulnerability occurs when Fetchmail performs a reply-hack action. The action is performed so that all addresses in email headers are searched for local email addresses. Next Fetchmail will allocate enough space for the case that all addresses are local addresses. Due to a flaw in the calculation, Fetchmail does not sufficiently allocate enough space.

An attacker can exploit this vulnerability by composing an email with specially crafted header lines and sending it to the vulnerable system. When Fetchmail attempts to parse the headers, it will allocate insufficient space and will result in Fetchmail corrupting heap memory with attacker-supplied values.

An attacker may exploit this condition to overwrite arbitrary words in memory. This may allow for the execution of arbitrary code.

- 漏洞利用

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: vuldb@securityfocus.com &lt;mailto:vuldb@securityfocus.com&gt;.

- 解决方案

Fetchmail 6.2.0 is not vulnerable to this issue. Users are advised to upgrade to the latest version of Fetchmail.

Gentoo Linux has released an advisory. Users who have installed net-mail/fetchmail-6.1.2 and earlier are urged to update their systems by issuing the following commands:

emerge rsync
emerge fetchmail
emerge clean

OpenPKG has released an advisory (OpenPKG-SA-2002.016) which addresses this issue. Fix information can be found in the attached advisory.

EnGarde Secure Linux has released a security advisory (ESA-20030127-002) which contains fixes. Users are urged to apply the supplied fixes as soon as possible.

Mandrake has released a security advisory (MDKSA-2003:011) containing fixes.

Immunix has released a security advisory (IMNX-2003-7+-023-01) including fixes.

Fixes are available:


Eric Raymond Fetchmail 5.3.3

Eric Raymond Fetchmail 5.4 .0

Eric Raymond Fetchmail 5.5

Eric Raymond Fetchmail 5.6

Eric Raymond Fetchmail 5.6.5

Eric Raymond Fetchmail 5.7

Eric Raymond Fetchmail 5.8 .0

Eric Raymond Fetchmail 5.9 .0

Eric Raymond Fetchmail 5.9.1

Eric Raymond Fetchmail 5.9.10

Eric Raymond Fetchmail 5.9.11

Eric Raymond Fetchmail 5.9.12

Eric Raymond Fetchmail 5.9.13

Eric Raymond Fetchmail 5.9.14

Eric Raymond Fetchmail 5.9.2

Eric Raymond Fetchmail 5.9.3

Eric Raymond Fetchmail 5.9.4

Eric Raymond Fetchmail 5.9.5

Eric Raymond Fetchmail 5.9.6

Eric Raymond Fetchmail 5.9.7

Eric Raymond Fetchmail 5.9.8

Eric Raymond Fetchmail 5.9.9

Eric Raymond Fetchmail 6.0 .0

Eric Raymond Fetchmail 6.1 .0

Eric Raymond Fetchmail 6.1.3

- 相关参考

 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站