发布日期：2004-08-16
更新日期：2004-08-18

受影响系统：

vpopmail vpopmail 5.4.2

描述：

---

BUGTRAQ  ID: 10990

Vpopmail是一套在QMAIL服务器上建立和管理多个虚拟域及其他功能的程序。

Vpopmail的vsybase.c中对参数缺少充分检查，远程攻击者可以利用这个漏洞进行缓冲区溢出和格式串攻击，可导致拒绝服务。

问题存在于vsybase.c中：

-------------------\
char dirbuf[156];  \__Vulnerability___________________________________________________
...                                                                                   |
if ( strlen(dir) > 0 )                                                                |
{                                                                                     |
sprintf(dirbuf,"%s/%s/%s", dom_dir,dir,user);                                         |
^^^^^^^ - buffer overflow                                                             |
}else{                                                                                |
sprintf(dirbuf, "%s/%s", dom_dir, user);                                              |
^^^^^^^ - buffer overflow                                                             |
}                                                                                     |
...                                                                                   |
                                                                                       |
if ( site_size == LARGE_SITE ) {                                                      |
        sprintf( SqlBuf, LARGE_INSERT, domstr,                                 |
                user, pass, pop, gecos, dirbuf, quota);                                |
                ^^^^^^^ - format string                                                |
    } else {                                                                       |
        sprintf( SqlBuf, SMALL_INSERT,                                         |
        SYBASE_DEFAULT_TABLE,  user, domain, pass, pop, gecos, dirbuf, quota); |
    }       ^^^^^^^ - format string  ______________________________________________|
----------------------------------------/

由于sprintf()对参数缺少充分边界检查，可导致触发缓冲区溢出，另外对user和SYBASE_DEFAULT_TABLE数据缺少过滤，提交格式串数据可触发内存覆盖，造成拒绝服务。

<*来源：Werro （werro@list.ru）
  
  链接：http://marc.theaimsgroup.com/?l=bugtraq&m=109276258830552&w=2
*>

建议：

---

厂商补丁：

vpopmail
--------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：

http://sourceforge.net/projects/vpopmail/

浏览次数：3281
严重程度：0（网友投票）