OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Daniel Ahlberg (aliz_at_gentoo.org)
Date: Sun Dec 15 2002 - 07:07:30 CST

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    - - --------------------------------------------------------------------
    GENTOO LINUX SECURITY ANNOUNCEMENT 200212-3
    - - --------------------------------------------------------------------

    PACKAGE : fetchmail
    SUMMARY : buffer overflow
    DATE    : 2002-12-15 13:12 UTC
    EXPLOIT : remote

    - - --------------------------------------------------------------------

    - From e-matters advisory:

    "In the light of recent discoveries we reaudited Fetchmail and found
    another bufferoverflow within the default configuration. This heap
    overflow can be used by remote attackers to crash it or to execute
    arbitrary code with the privileges of the user running fetchmail.
    Depending on the configuration this allows a remote root compromise."

    Read the full advisory at
    http://security.e-matters.de/advisories/052002.html

    SOLUTION

    It is recommended that all Gentoo Linux users who are running
    net-mail/fetchmail-6.1.2 and earlier update their systems as follows:

    emerge rsync
    emerge fetchmail
    emerge clean

    - - --------------------------------------------------------------------
    alizgentoo.org - GnuPG key is available at www.gentoo.org/~aliz
    avenjgentoo.org
    - - --------------------------------------------------------------------
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.2.1 (GNU/Linux)

    iD8DBQE9/H6GfT7nyhUpoZMRAsaYAJ91S9qnCMg7K52RKryLUMuWi0URIACgpFdF
    AUF2cEn+Y8qLPsolPSSIf0s=
    =nDtt
    -----END PGP SIGNATURE-----