发布日期：2001-06-17
更新日期：2001-06-27

受影响系统：

Eric Raymond Fetchmail 5.8.6以下版本
Eric Raymond Fetchmail 5.7.2
Eric Raymond Fetchmail 5.7.1
   - Debian Linux 2.3
Eric Raymond Fetchmail 5.7
Eric Raymond Fetchmail 5.6.x
Eric Raymond Fetchmail 5.5.6
Eric Raymond Fetchmail 5.5.5
   - Conectiva Linux 6.0
   - Conectiva Linux 5.1
   - Conectiva Linux 5.0
   - Conectiva Linux graficas
   - Conectiva Linux ecommerce
Eric Raymond Fetchmail 5.5.4
Eric Raymond Fetchmail 5.5.3
Eric Raymond Fetchmail 5.5.2
Eric Raymond Fetchmail 5.5.1
Eric Raymond Fetchmail 5.5
   - Immunix Immunix OS 7.0beta
   - Immunix Immunix OS 7.0
Eric Raymond Fetchmail 5.4.5
Eric Raymond Fetchmail 5.4.4
Eric Raymond Fetchmail 5.4.3
Eric Raymond Fetchmail 5.4.2
Eric Raymond Fetchmail 5.4.1
Eric Raymond Fetchmail 5.4
   - Guardian Digital Engarde Secure Linux 1.0.1
Eric Raymond Fetchmail 5.3.8
Eric Raymond Fetchmail 5.3.7
Eric Raymond Fetchmail 5.3.6
Eric Raymond Fetchmail 5.3.5
Eric Raymond Fetchmail 5.3.4
Eric Raymond Fetchmail 5.3.3
   - Debian Linux 2.2
Eric Raymond Fetchmail 5.3.2
Eric Raymond Fetchmail 5.3.1
   - Immunix Immunix OS 6.2
Eric Raymond Fetchmail 5.3
Eric Raymond Fetchmail 5.2
   - Caldera eDesktop 2.4
Eric Raymond Fetchmail 5.1
Eric Raymond Fetchmail 5.0
   - Conectiva Linux 4.2
   - Conectiva Linux 4.1
   - Conectiva Linux 4.0es
   - Conectiva Linux 4.0
   - Caldera eServer 2.3
   - Caldera OpenLinux 2.3

描述：

---

BUGTRAQ  ID: 2877
CVE(CAN) ID: CVE-2001-0819

Fetchmail是unix下通过POP协议下载邮件的应用程序，发现其在处理邮件头信息的时候
存在缓冲区溢出漏洞。

如果邮件的“To:”域太大的话，Fetchmail就会在本地缓冲区溢出。因为Fetchmail经常
以root身份运行的，因此，远程攻击者通过发送一封精心构造头部信息的邮件，可
能导致以root身份执行任意代码。

<*来源：Wolfram Kleff （kleff@cs.uni-bon.de)
  参考：http://bugs.debian.org/100394
*>

建议：

---

厂商补丁：

目前Immunix, Debian, Conectiva, Guardian Digital (Engarde Secure Linux) 和
Caldera 已经发布了安全公告和升级补丁。

Eric Raymond Fetchmail 5.7.1:

Debian patch 2.2 fetchmail-5.7.1-2.diff
http://www.securityfocus.com/data/vulnerabilities/patches/fetchmail-5.7.1-2.diff

Eric Raymond Fetchmail 5.5.5:

Conectiva RPM 5.0 fetchmail-5.5.5-2U50_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/5.0/i386/fetchmail-5.5.5-2U50_1cl.i386.rpm

Conectiva RPM 5.0 fetchmailconf-5.5.5-2U50_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/5.0/i386/fetchmailconf-5.5.5-2U50_1cl.i386.rpm

Conectiva RPM 5.1 fetchmail-5.5.5-2U51_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/5.1/i386/fetchmail-5.5.5-U51_1cl.i386.rpm

Conectiva RPM 5.1 fetchmailconf-5.5.5-2U51_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/5.1/i386/fetchmailconf-5.5.5-2U51_1cl.i386.rpm

Conectiva RPM 6.0 fetchmailconf-5.5.5-2U60_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/fetchmailconf-5.5.5-2U60_1cl.i386.rpm

Conectiva RPM 6.0 fetchmail-5.5.5-2U60_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/fetchmail-5.5.5-2U60_1cl.i386.rpm

Conectiva RPM ecommerce fetchmail-5.5.5-2U50_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/ecommerce/i386/fetchmail-5.5.5-2U50_1cl.i386.rpm

Conectiva RPM ecommerce fetchmailconf-5.5.5-2U50_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/ecommerce/i386/fetchmailconf-5.5.5-2U50_1cl.i386.rpm

Conectiva RPM graficas fetchmail-5.5.5-2U50_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/graficas/i386/fetchmail-5.5.5-2U50_1cl.i386.rpm

Conectiva RPM graficas fetchmailconf-5.5.5-2U50_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/graficas/i386/fetchmailconf-5.5.5-2U50_1cl.i386.rpm

Eric Raymond Fetchmail 5.5:

Immunix RPM 7.0/7.0-beta fetchmail-5.5.0-4_imnx.i386.rpm
http://download.immunix.org/ImmunixOS/7.0/updates/RPMS/fetchmail-5.5.0-4_imnx.i386.rpm

Immunix RPM 7.0/7.0-beta fetchmailconf-5.5.0-4_imnx.i386.rpm
http://download.immunix.org/ImmunixOS/7.0/updates/RPMS/fetchmailconf-5.5.0-4_imnx.i386.rpm

Eric Raymond Fetchmail 5.4:

Engarde Secure Linux RPM 1.0.1 i386 fetchmail-ssl-5.8.7-1.0.2.i386.rpm
http://ftp.ibiblio.org/pub/linux/distributions/engarde/stable/updates/i386/fetchmail-ssl-5.8.7-1.0.2.i386.rpm

Engarde Secure Linux RPM 1.0.1 i686 fetchmail-ssl-5.8.7-1.0.2.i686.rpm
http://ftp.ibiblio.org/pub/linux/distributions/engarde/stable/updates/i686/fetchmail-ssl-5.8.7-1.0.2.i686.rpm

Eric Raymond Fetchmail 5.3.3:

Debian upgrade 2.2 alpha fetchmail_5.3.3-1.2_alpha.deb
http://security.debian.org/dists/stable/updates/main/binary-alpha/fetchmail_5.3.3-1.2_alpha.deb

Debian upgrade 2.2 arm fetchmail_5.3.3-1.2_arm.deb
http://security.debian.org/dists/stable/updates/main/binary-arm/fetchmail_5.3.3-1.2_arm.deb

Debian upgrade 2.2 i386 fetchmail_5.3.3-1.2_i386.deb
http://security.debian.org/dists/stable/updates/main/binary-i386/fetchmail_5.3.3-1.2_i386.deb

Debian upgrade 2.2 m68k fetchmail_5.3.3-1.2_m68k.deb
http://security.debian.org/dists/stable/updates/main/binary-m68k/fetchmail_5.3.3-1.2_m68k.deb

Debian upgrade 2.2 ppc fetchmail_5.3.3-1.2_powerpc.deb
http://security.debian.org/dists/stable/updates/main/binary-powerpc/fetchmail_5.3.3-1.2_powerpc.deb

Debian upgrade 2.2 sparc fetchmail_5.3.3-1.2_sparc.deb
http://security.debian.org/dists/stable/updates/main/binary-sparc/fetchmail_5.3.3-1.2_sparc.deb

Eric Raymond Fetchmail 5.3.1:

Immunix RPM 6.2 fetchmail-5.3.1-2_StackGuard.i386.rpm
http://download.immunix.org/ImmunixOS/6.2/updates/RPMS/fetchmail-5.3.1-2_StackGuard.i386.rpm

Immunix RPM 6.2 fetchmailconf-5.3.1-2_StackGuard.i386.rpm
http://download.immunix.org/ImmunixOS/6.2/updates/RPMS/fetchmailconf-5.3.1-2_StackGuard.i386.rpm

Eric Raymond Fetchmail 5.2:

Caldera RPM eDesktop 2.4 fetchmail-5.2.0-2.i386.rpm
ftp://ftp.caldera.com/pub/updates/eDesktop/2.4/current/RPMS/fetchmail-5.2.0-2.i386.rpm

Eric Raymond Fetchmail 5.0:

Conectiva RPM 4.0 fetchmailconf-5.0.0-5U40_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/4.0/i386/fetchmailconf-5.0.0-5U40_1cl.i386.rpm

Conectiva RPM 4.0 fetchmail-5.0.0-5U40_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/4.0/i386/fetchmail-5.0.0-5U40_1cl.i386.rpm

Conectiva RPM 4.0es fetchmailconf-5.0.0-5U40_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/4.0es/i386/fetchmailconf-5.0.0-5U40_1cl.i386.rpm

Conectiva RPM 4.0es fetchmail-5.0.0-5U40_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/4.0es/i386/fetchmail-5.0.0-5U40_1cl.i386.rpm

Conectiva RPM 4.1 fetchmailconf-5.0.0-6U41_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/4.1/i386/fetchmailconf-5.0.0-6U41_1cl.i386.rpm

Conectiva RPM 4.1 fetchmail-5.0.0-6U41_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/4.1/i386/fetchmail-5.0.0-6U41_1cl.i386.rpm

Conectiva RPM 4.2 fetchmailconf-5.0.0-6U42_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/4.2/i386/fetchmailconf-5.0.0-6U42_1cl.i386.rpm

Conectiva RPM 4.2 fetchmail-5.0.0-6U42_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/4.2/i386/fetchmail-5.0.0-6U42_1cl.i386.rpm

Caldera RPM OpenLinux 2.3 fetchmail-5.0.4-1.i386.rpm
ftp://ftp.caldera.com/pub/updates/OpenLinux/2.3/current/RPMS/fetchmail-5.0.4-1.i386.rpm

Caldera RPM eServer 2.3/eBuilder for ECential 3.0 fetchmail-5.0.4-1.i386.rpm
ftp://ftp.caldera.com/pub/updates/eServer/2.3/current/RPMS/fetchmail-5.0.4-1.i386.rpm


浏览次数：7646
严重程度：0（网友投票）