Login
Newsletter
Werbung

Sicherheit: Pufferüberlauf in fetchmail
Aktuelle Meldungen Distributionen
Name: Pufferüberlauf in fetchmail
ID: USN-153-1
Distribution: Ubuntu
Plattformen: Ubuntu 4.10, Ubuntu 5.04
Datum: Mi, 27. Juli 2005, 13:00
Referenzen: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2335
Applikationen: Fetchmail

Originalnachricht

--===============0285095278=	protocol="application/pgp-signature";
boundary="AhhlLboLdkugWU4S"
Content-Disposition: inline


--AhhlLboLdkugWU4S
Content-Disposition: inline

===========================================================
Ubuntu Security Notice USN-153-1 July 26, 2005
fetchmail vulnerability
CAN-2005-2335
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 4.10 (Warty Warthog)
Ubuntu 5.04 (Hoary Hedgehog)

The following packages are affected:

fetchmail

The problem can be corrected by upgrading the affected package to
version 6.2.5-8ubuntu2.1 (for Ubuntu 4.10), or 6.2.5-12ubuntu1.1 (for
Ubuntu 5.04). In general, a standard system upgrade is sufficient to
effect the necessary changes.

Details follow:

Ross Boylan discovered a remote buffer overflow in fetchmail. By
sending invalid responses with very long UIDs, a faulty or malicious
POP server could crash fetchmail or execute arbitrary code with the
privileges of the user invoking fetchmail.

fetchmail is commonly run as root to fetch mail for multiple user
accounts; in this case, this vulnerability could be exploited to
compromise the whole system.


Updated packages for Ubuntu 4.10 (Warty Warthog):

Source archives:

fetchmail_6.2.5-8ubuntu2.1.diff.gz
Size/MD5: 136209 d982f973b3675ce97816a2f551e63996
fetchmail_6.2.5-8ubuntu2.1.dsc
Size/MD5: 639 5f2255e5e60e93b117686154bd748329
fetchmail_6.2.5.orig.tar.gz
Size/MD5: 1257376 9956b30139edaa4f5f77c4d0dbd80225

Architecture independent packages:

fetchmailconf_6.2.5-8ubuntu2.1_all.deb
Size/MD5: 101418 a4ffcc8ebdb17707de6369db25ea7e52

amd64 architecture (Athlon64, Opteron, EM64T Xeon)

fetchmail_6.2.5-8ubuntu2.1_amd64.deb
Size/MD5: 555560 0b695cf0702e535bb8146bec44f5f13c

i386 architecture (x86 compatible Intel/AMD)

fetchmail_6.2.5-8ubuntu2.1_i386.deb
Size/MD5: 546196 1455931de7ac299e5b8b1ff3c0763493

powerpc architecture (Apple Macintosh G3/G4/G5)

fetchmail_6.2.5-8ubuntu2.1_powerpc.deb
Size/MD5: 556014 b48d28fec277b18a0e52738901461c18

Updated packages for Ubuntu 5.04 (Hoary Hedgehog):

Source archives:

fetchmail_6.2.5-12ubuntu1.1.diff.gz
Size/MD5: 150286 b30b78bd0affc998fe6d9a192902e766
fetchmail_6.2.5-12ubuntu1.1.dsc
Size/MD5: 656 3a3527e59e6402ac8800491a675f4f70
fetchmail_6.2.5.orig.tar.gz
Size/MD5: 1257376 9956b30139edaa4f5f77c4d0dbd80225

Architecture independent packages:

fetchmail-ssl_6.2.5-12ubuntu1.1_all.deb
Size/MD5: 42260 dfc95a76d0f6716d7f6bbefcaf0bd071
fetchmailconf_6.2.5-12ubuntu1.1_all.deb
Size/MD5: 101284 451d0af692ad0855377e151c6e93b5bc

amd64 architecture (Athlon64, Opteron, EM64T Xeon)

fetchmail_6.2.5-12ubuntu1.1_amd64.deb
Size/MD5: 296788 fe851a27dca46bd2d9972c88aaa8af74

i386 architecture (x86 compatible Intel/AMD)

fetchmail_6.2.5-12ubuntu1.1_i386.deb
Size/MD5: 286052 eeb6ecb0dbc43fadd84297cc85f9e1d7

powerpc architecture (Apple Macintosh G3/G4/G5)

fetchmail_6.2.5-12ubuntu1.1_powerpc.deb
Size/MD5: 296080 bb012afc1d28ec40c801410b9d0612c4




--AhhlLboLdkugWU4S
Content-Description: Digital signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (GNU/Linux)

iD8DBQFC5hKoDecnbV4Fd/IRApitAKCfb4/+DnYeWBF/b06+Ew6XuJ/l0wCfb4R0
RjtlKBmMjc0yXh5vKxS94IU=
=dRDi
-----END PGP SIGNATURE-----

--AhhlLboLdkugWU4S--


--===============0285095278=MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
http://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce



--===============0285095278==--
Pro-Linux
Pro-Linux @Facebook
Neue Nachrichten
Werbung