[fetchmail-announce] fetchmail 6.3.14 security fix release and fetchmail-SA-2010-01 security announcement
Matthias Andree
matthias.andree at gmx.de
Fri Feb 5 02:46:43 CET 2010
Greetings,
I am announcing the release of fetchmail 6.3.14. This new stable
version of fetchmail fixes a bug introduced into 6.3.11 that could cause
heap corruption in verbose mode when displaying X.509 SSL/TLS
certificates that contained characters with high bit set on platforms
where the "char" type is signed. 6.3.14 also fixes a variety of IMAP
bugs. See below for details. Unfortunately the CVE id hasn't yet been
assigned; once it has been, I will update the online version of the
security announcement.
The software is available from:
<http://developer.berlios.de/project/showfiles.php?group_id=1824>
The fetchmail home pages are:
<http://www.fetchmail.info/> or <http://fetchmail.berlios.de/>
These are the relevant changes since the previous release. Unless
otherwise noted, changes to this release were made by Matthias Andree
(in fact, most fixes were by Sunil Shetye this time):
# SECURITY FIXES
* SSL/TLS certificate information is now also reported properly on computers
that consider the "char" type signed. Fixes malloc() buffer overrun.
Workaround for older versions: do not use verbose mode.
See fetchmail-SA-2010-01.txt for details, including a minimal patch.
# BUG FIXES
* The IMAP client no longer skips messages from several IMAP servers including
Dovecot if fetchmail's "idle" is in use. Causes were that fetchmail (a)
ignored some untagged responses when it should not (b) relied on EXISTS
messages in response to EXPUNGE, which aren't mandated by RFC-3501 (the IMAP
standard) and aren't sent by Dovecot either.
Fix by Sunil Shetye (the fix also consolidates IMAP response handling,
improving overall robustness of the IMAP client), bug report and testing by
Matt Doran, with further hints from Timo Sirainen.
* The SMTP client now recovers from errors (such as servers dropping the
connection after errors) when sending an RSET command.
Fix by Sunil Shetye. Report by James Moe.
* The IMAP client now uses "SEARCH UNSEEN" rather than "SEARCH UNSEEN NOT
DELETED" again on IMAP2, to fix a regression in fetchmail 6.2.5 reported by
Will Stringer in June 2004. (Sunil Shetye)
* The IMAP client now uses "SEARCH UNSEEN UNDELETED" on IMAP4 and IMAP4r1
servers (Sunil Shetye).
* Workaround: The IMAP client now falls back to "FETCH n:m FLAGS" if the server
does not support "SEARCH". (Sunil Shetye)
* The IMAP client now requests message numbers in batches of 1,000 to avoid
problems if there are more than 1860 unseen messages. (Sunil Shetye)
Note that this wasn't security relevant because fetchmail would only read up
to the maximum buffer size and leave the remainder of the string unread, going
out of synch afterwards.
* Stricter validation of IMAP responses containing byte or message counts.
# CHANGES
* Only include gssapi.h if we're not including gssapi/gssapi.h, to fix a FreeBSD
compiler warning about gssapi.h being obsolete.
# DOCUMENTATION
* The README.SSL document was revised for grammar, spelling, and clarity.
Courtesy of Robert Mullin.
# TRANSLATION UPDATES
* [it] Italian, by Vincenzo Campanella
--
Matthias Andree
-------------- next part --------------
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
fetchmail-SA-2010-01: Heap overrun in verbose SSL cert' info display.
Topics: Heap overrun in verbose SSL certificate information display.
Author: Matthias Andree
Version: 1.0
Announced:
Type: malloc() Buffer overrun with printable characters
Impact: Code injection (difficult).
Danger: low
CVE Name: to be assigned via oss-security@ list
URL: http://www.fetchmail.info/fetchmail-SA-2010-01.txt
Project URL: http://www.fetchmail.info/
Affects: fetchmail releases 6.3.11, 6.3.12, and 6.3.13
Not affected: fetchmail release 6.3.14 and newer
Corrected: 2010-02-04 fetchmail SVN (r5467)
2010-02-05 fetchmail release 6.3.14
0. Release history
==================
2010-02-04 0.1 first draft (visible in SVN and through oss-security)
2010-02-05 1.0 fixed signed/unsigned typo (found by Nico Golde)
1. Background
=============
fetchmail is a software package to retrieve mail from remote POP2, POP3,
IMAP, ETRN or ODMR servers and forward it to local SMTP, LMTP servers or
message delivery agents. It supports SSL and TLS security layers through
the OpenSSL library, if enabled at compile time and if also enabled at
run time.
2. Problem description and Impact
=================================
In verbose mode, fetchmail prints X.509 certificate subject and issuer
information to the user, and counts and allocates a malloc() buffer for
that purpose.
If the material to be displayed contains characters with high bit set
and the platform treats the "char" type as signed, this can cause a heap
buffer overrun because non-printing characters are escaped as
\xFF..FFnn, where nn is 80..FF in hex.
This might be exploitable to inject code if
- - fetchmail is run in verbose mode
AND
- - the host running fetchmail considers char signed
AND
- - the server uses malicious certificates with non-printing characters
that have the high bit set
AND
- - these certificates manage to inject shell-code that consists purely of
printable characters.
It is believed to be difficult to achieve all this.
3. Solution
===========
There are two alternatives, either of them by itself is sufficient:
a. Apply the patch found in section B of this announcement to
fetchmail 6.3.13, recompile and reinstall it.
b. Install fetchmail 6.3.14 or newer after it will have become available.
The fetchmail source code is always available from
<http://developer.berlios.de/project/showfiles.php?group_id=1824>.
4. Workaround
=============
Run fetchmail without and verbose options.
A. Copyright, License and Warranty
==================================
(C) Copyright 2010 by Matthias Andree, <matthias.andree at gmx.de>.
Some rights reserved.
This work is licensed under the Creative Commons
Attribution-Noncommercial-No Derivative Works 3.0 Germany License.
To view a copy of this license, visit
http://creativecommons.org/licenses/by-nc-nd/3.0/de/ or send a letter to
Creative Commons
171 Second Street
Suite 300
SAN FRANCISCO, CALIFORNIA 94105
USA
THIS WORK IS PROVIDED FREE OF CHARGE AND WITHOUT ANY WARRANTIES.
Use the information herein at your own risk.
B. Patch to remedy the problem
==============================
Note that when taking this from a GnuPG clearsigned file, the lines
starting with a "-" character are prefixed by another "- " (dash +
blank) combination. Either feed this file through GnuPG to strip them,
or strip them manually. You may want to use the "-p1" flag to patch.
Whitespace differences can usually be ignored by invoking "patch -l",
so try this if the patch does not apply.
- --- a/sdump.c
+++ b/sdump.c
@@ -36,7 +36,7 @@ char *sdump(const char *in, size_t len)
if (isprint((unsigned char)in[i])) {
*(oi++) = in[i];
} else {
- - oi += sprintf(oi, "\\x%02X", in[i]);
+ oi += sprintf(oi, "\\x%02X", (unsigned char)in[i]);
}
}
*oi = '\0';
END OF fetchmail-SA-2010-01.txt
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.12 (GNU/Linux)
iEYEARECAAYFAktrbs0ACgkQvmGDOQUufZWzMQCg49F/WJiOjGwWZKHHzBcfTgx/
sLIAmQHPO3mezy3Ku0O29b4AXHL2ZQNb
=kF7s
-----END PGP SIGNATURE-----
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: not available
URL: <https://lists.berlios.de/pipermail/fetchmail-announce/attachments/20100205/42a755c3/attachment.pgp>
More information about the fetchmail-announce
mailing list