SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker
bugs
@
securitytracker.com






Category:   Application (E-mail Server)  >   Fetchmail Vendors:   fetchmail.berlios.de
Fetchmail Heap Overflow When Displaying SSL Certificates in Verbose Mode May Let Remote Users Execute Arbitrary Code
SecurityTracker Alert ID:  1023543
SecurityTracker URL:  http://securitytracker.com/id/1023543
CVE Reference:   CVE-2010-0562   (Links to External Site)
Updated:  Feb 10 2010
Original Entry Date:  Feb 4 2010
Impact:   Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 6.3.11, 6.3.12, 6.3.13
Description:   A vulnerability was reported in Fetchmail. A remote user can execute arbitrary code on the target system.

A remote server can send a specially crafted certificate to trigger a heap overflow if the target fetchmail application is running in verbose mode. Certain non-printing characters can trigger the overflow and potentially execute arbitrary code on the target system. The code will run with the privileges of the target service.

The vulnerability resides in 'sdump.c'.

Impact:   A remote user may be able to execute arbitrary code on the target system.
Solution:   The vendor has issued a fix (6.3.14).

The vendor's advisory is available at:

http://www.fetchmail.info/fetchmail-SA-2010-01.txt

Vendor URL:  www.fetchmail.info/fetchmail-SA-2010-01.txt (Links to External Site)
Cause:   Boundary error
Underlying OS:   Linux (Any), UNIX (Any)

Message History:   None.


 Source Message Contents

Date:  Thu, 04 Feb 2010 22:54:22 +0000
Subject:  Fetchmail


fetchmail-SA-2010-01: Heap overrun in verbose SSL cert' info display.

Topics:		Heap overrun in verbose SSL certificate information display.

Author:		Matthias Andree
Version:	1.0
Announced:
Type:		malloc() Buffer overrun with printable characters
Impact:		Code injection (difficult).
Danger:		low
CVSSv2 vectors:

CVE Name:
URL:		http://www.fetchmail.info/fetchmail-SA-2010-01.txt
Project URL:	http://www.fetchmail.info/

Affects:	fetchmail releases 6.3.11, 6.3.12, and 6.3.13

Not affected:	fetchmail release 6.3.14 and newer

Corrected:	2010-02-04 fetchmail SVN (r5467)


0. Release history
==================

2010-02-04 0.1	first draft (visible in SVN)


1. Background
=============

fetchmail is a software package to retrieve mail from remote POP2, POP3,
IMAP, ETRN or ODMR servers and forward it to local SMTP, LMTP servers or
message delivery agents. It supports SSL and TLS security layers through
the OpenSSL library, if enabled at compile time and if also enabled at
run time.


2. Problem description and Impact
=================================

In verbose mode, fetchmail prints X.509 certificate subject and issuer
information to the user, and counts and allocates a malloc() buffer for
that purpose.

If the material to be displayed contains characters with high bit set
and the platform treats the "char" type as signed, this can cause a heap
buffer overrun because non-printing characters are escaped as
\xFF..FFnn, where nn is 80..FF in hex.

This might be exploitable to inject code if
- fetchmail is run in verbose mode
AND
- the host running fetchmail considers char signed
AND
- the server uses malicious certificates with non-printing characters
  that have the high bit set
AND
- these certificates manage to inject shell-code that consists purely of
  printable characters.

It is believed to be difficult to achieve all this.


3. Solution
===========

There are two alternatives, either of them by itself is sufficient:

a. Apply the patch found in section B of this announcement to
   fetchmail 6.3.13, recompile and reinstall it.

b. Install fetchmail 6.3.14 or newer after it will have become available.
   The fetchmail source code is always available from
   <http://developer.berlios.de/project/showfiles.php?group_id=1824>.


4. Workaround
=============

Run fetchmail without and verbose options.


A. Copyright, License and Warranty
==================================

(C) Copyright 2010 by Matthias Andree, <matthias.andree@gmx.de>.
Some rights reserved.

This work is licensed under the Creative Commons
Attribution-Noncommercial-No Derivative Works 3.0 Germany License.
To view a copy of this license, visit
http://creativecommons.org/licenses/by-nc-nd/3.0/de/ or send a letter to

Creative Commons
171 Second Street
Suite 300
SAN FRANCISCO, CALIFORNIA 94105
USA


THIS WORK IS PROVIDED FREE OF CHARGE AND WITHOUT ANY WARRANTIES.
Use the information herein at your own risk.


B. Patch to remedy the problem
==============================

Note that when taking this from a GnuPG clearsigned file, the lines
starting with a "-" character are prefixed by another "- " (dash +
blank) combination. Either feed this file through GnuPG to strip them,
or strip them manually. You may want to use the "-p1" flag to patch.

Whitespace differences can usually be ignored by invoking "patch -l",
so try this if the patch does not apply.

--- a/sdump.c
+++ b/sdump.c
@@ -36,7 +36,7 @@ char *sdump(const char *in, size_t len)
 	if (isprint((unsigned char)in[i])) {
 	    *(oi++) = in[i];
 	} else {
-	    oi += sprintf(oi, "\\x%02X", in[i]);
+	    oi += sprintf(oi, "\\x%02X", (unsigned char)in[i]);
 	}
     }
     *oi = '\0';

END OF fetchmail-SA-2010-01.txt

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

Copyright 2014, SecurityGlobal.net LLC