Vulnerability Bulletins |
Desbordamiento de búfer en fetchmail |
|
Vulnerability classification |
|
| Property | Value |
| Confidence level | Oficial |
| Impact | Obtener acceso |
| Dificulty | Experto |
| Required attacker level | Acceso remoto sin cuenta a un servicio estandar |
System information |
|
| Property | Value |
| Affected manufacturer | GNU/Linux |
| Affected software | fetchmail |
Description |
|
|
Se ha descubierto una vulnerabilidad de desbordamiento de búfer en fetchmail. La vulnerabilidad reside en el cliente POP3, concretamente en el manejo de los UID de mensajes. La explotación de esta vulnerabilidad podría permitir a un atacante remoto ejecutar código arbitrario mediante un mensaje especialmente diseñado. El código se ejecutaría con los privilegios del usuario que ejecute fetchmail. |
|
Solution |
|
|
Actualización de software Red Hat Linux Red Hat Desktop (v. 3) Red Hat Desktop (v. 4) Red Hat Enterprise Linux AS (v. 2.1) Red Hat Enterprise Linux AS (v. 3) Red Hat Enterprise Linux AS (v. 4) Red Hat Enterprise Linux ES (v. 2.1) Red Hat Enterprise Linux ES (v. 3) Red Hat Enterprise Linux ES (v. 4) Red Hat Enterprise Linux WS (v. 2.1) Red Hat Enterprise Linux WS (v. 3) Red Hat Enterprise Linux WS (v. 4) Red Hat Linux Advanced Workstation 2.1 Itanium Processor https://rhn.redhat.com/ Mandriva Linux Mandrakelinux 10.1 x86 ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.1/RPMS/fetchmail-6.2.5-5.1.101mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.1/RPMS/fetchmail-daemon-6.2.5-5.1.101mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.1/RPMS/fetchmailconf-6.2.5-5.1.101mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.1/SRPMS/fetchmail-6.2.5-5.1.101mdk.src.rpm X86_64 ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/10.1/RPMS/fetchmail-6.2.5-5.1.101mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/10.1/RPMS/fetchmail-daemon-6.2.5-5.1.101mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/10.1/RPMS/fetchmailconf-6.2.5-5.1.101mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/10.1/SRPMS/fetchmail-6.2.5-5.1.101mdk.src.rpm Corporate Server 2.1 x86 ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/2.1/RPMS/fetchmail-6.1.0-1.3.C21mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/2.1/RPMS/fetchmail-daemon-6.1.0-1.3.C21mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/2.1/RPMS/fetchmailconf-6.1.0-1.3.C21mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/2.1/SRPMS/fetchmail-6.1.0-1.3.C21mdk.src.rpm X86_64 ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/corporate/2.1/RPMS/fetchmail-6.1.0-1.3.C21mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/corporate/2.1/RPMS/fetchmail-daemon-6.1.0-1.3.C21mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/corporate/2.1/RPMS/fetchmailconf-6.1.0-1.3.C21mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/corporate/2.1/SRPMS/fetchmail-6.1.0-1.3.C21mdk.src.rpm Corporate Server 3.0 x86 ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/3.0/RPMS/fetchmail-6.2.5-3.1.C30mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/3.0/RPMS/fetchmail-daemon-6.2.5-3.1.C30mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/3.0/RPMS/fetchmailconf-6.2.5-3.1.C30mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/3.0/SRPMS/fetchmail-6.2.5-3.1.C30mdk.src.rpm X86_64 ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/corporate/3.0/RPMS/fetchmail-6.2.5-3.1.C30mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/corporate/3.0/RPMS/fetchmail-daemon-6.2.5-3.1.C30mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/corporate/3.0/RPMS/fetchmailconf-6.2.5-3.1.C30mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/corporate/3.0/SRPMS/fetchmail-6.2.5-3.1.C30mdk.src.rpm Mandrivalinux LE2005 x86 ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.2/RPMS/fetchmail-6.2.5-10.1.102mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.2/RPMS/fetchmail-daemon-6.2.5-10.1.102mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.2/RPMS/fetchmailconf-6.2.5-10.1.102mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.2/SRPMS/fetchmail-6.2.5-10.1.102mdk.src.rpm X86_64 ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/10.2/RPMS/fetchmail-6.2.5-10.1.102mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/10.2/RPMS/fetchmail-daemon-6.2.5-10.1.102mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/10.2/RPMS/fetchmailconf-6.2.5-10.1.102mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/10.2/SRPMS/fetchmail-6.2.5-10.1.102mdk.src.rpm Mandrivalinux 2006 X86 ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2006.0/RPMS/fetchmail-6.2.5-11.1.20060mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2006.0/RPMS/fetchmailconf-6.2.5-11.1.20060mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2006.0/RPMS/fetchmail-daemon-6.2.5-11.1.20060mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2006.0/SRPMS/fetchmail-6.2.5-11.1.20060mdk.src.rpm X86_64 ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/2006.0/RPMS/fetchmail-6.2.5-11.1.20060mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/2006.0/RPMS/fetchmailconf-6.2.5-11.1.20060mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/2006.0/RPMS/fetchmail-daemon-6.2.5-11.1.20060mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/2006.0/SRPMS/fetchmail-6.2.5-11.1.20060mdk.src.rpm SUSE Linux Actualizar mediante YaST Online Update Debian Linux Debian Linux 3.1 Source http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_6.2.5-12sarge1.dsc http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_6.2.5-12sarge1.diff.gz http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_6.2.5.orig.tar.gz Architecture independent http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail-ssl_6.2.5-12sarge1_all.deb http://security.debian.org/pool/updates/main/f/fetchmail/fetchmailconf_6.2.5-12sarge1_all.deb Alpha http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_6.2.5-12sarge1_alpha.deb AMD64 http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_6.2.5-12sarge1_amd64.deb ARM http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_6.2.5-12sarge1_arm.deb Intel IA-32 http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_6.2.5-12sarge1_i386.deb Intel IA-64 http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_6.2.5-12sarge1_ia64.deb HP Precision http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_6.2.5-12sarge1_hppa.deb Motorola 680x0 http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_6.2.5-12sarge1_m68k.deb Big endian MIPS http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_6.2.5-12sarge1_mips.deb Little endian MIPS http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_6.2.5-12sarge1_mipsel.deb PowerPC http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_6.2.5-12sarge1_powerpc.deb IBM S/390 http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_6.2.5-12sarge1_s390.deb Sun Sparc http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_6.2.5-12sarge1_sparc.deb SGI SGI Advanced Linux Environment 3 ftp://oss.sgi.com/projects/sgi_propack/download/3/updates/RPMS ftp://oss.sgi.com/projects/sgi_propack/download/3/updates/SRPMS Apple Mac OS X 10.3.9 Client http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=11230&cat=1&platform=osx&method=sa/SecUpd2006-004Pan.dmg Mac OS X 10.3.9 Server http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=11231&cat=1&platform=osx&method=sa/SecUpdSrvr2006-004Pan.dmg Mac OS X 10.4.7 Client (Intel) http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=11232&cat=1&platform=osx&method=sa/SecUpd2006-004Intel.dmg Mac OS X 10.4.7 Client (PPC) http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=11233&cat=1&platform=osx&method=sa/SecUpd2006-004Ti.dmg |
|
Standar resources |
|
| Property | Value |
| CVE | CAN-2005-2335 |
| BID | |
Other resources |
|
|
Red Hat Security Advisory RHSA-2005:640-08 https://rhn.redhat.com/errata/RHSA-2005-640.html Mandriva Security Advisories MDKSA-2005:126 http://www.mandriva.com/security/advisories?name=MDKSA-2005:126 Mandriva Security Advisory (MDKSA-2005:209) http://www.mandriva.com/security/advisories?name=MDKSA-2005:209 SUSE Security Summary Report SUSE-SR:2005:018 http://www.novell.com/linux/security/advisories/2005_18_sr.html Debian Security Advisory DSA 774-1 http://lists.debian.org/debian-security-announce/debian-security-announce-2005/msg00161.html SGI Security advisory 20050802-01-U ftp://patches.sgi.com/support/free/security/advisories/20050802-01-U.asc Apple Security Update (2006-004) http://docs.info.apple.com/article.html?artnum=304063 |
|
Version history |
||
| Version | Comments | Date |
| 1.0 | Aviso emitido | 2005-07-25 |
| 1.1 | Aviso emitido por Mandriva (MDKSA-2005:126) | 2005-07-29 |
| 1.2 | Aviso emitido por SUSE (SUSE-SR:2005:018) | 2005-08-02 |
| 1.3 | Aviso emitido por Debian (DSA 774-1). Aviso emitido por SGI (20050802-01-U) | 2005-08-31 |
| 1.4 | Aviso actualizado por Mandriva (MDKSA-2005:209) | 2005-11-11 |
| 1.5 | Aviso emitido por Apple (2006-004) | 2006-08-02 |