From owner-freebsd-questions Tue Jul 21 03:07:57 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id DAA20041 for freebsd-questions-outgoing; Tue, 21 Jul 1998 03:07:57 -0700 (PDT) (envelope-from owner-freebsd-questions@FreeBSD.ORG) Received: from picasso.tellique.de ([62.144.106.2]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id DAA20011 for ; Tue, 21 Jul 1998 03:07:47 -0700 (PDT) (envelope-from ni@tellique.de) Received: from tellique.de (nolde.tellique.de [62.144.106.52]) by picasso.tellique.de (8.8.8/8.8.8) with ESMTP id MAA07397; Tue, 21 Jul 1998 12:05:39 +0200 (MET DST) Message-ID: <35B468E6.E27EA537@tellique.de> Date: Tue, 21 Jul 1998 12:09:42 +0200 From: Juergen Nickelsen Organization: Tellique Kommunikationstechnik GmbH X-Mailer: Mozilla 4.05 [en] (WinNT; U) MIME-Version: 1.0 To: Val CC: freebsd-questions@FreeBSD.ORG Subject: Re: Off topic - popper security References: Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG In , Val wrote: > Today i got a call from a concerned individual who is alleging > that trough the /usr/local/libexec/popper one can get into the system. [...] > Did anyone hear about this problem? What is the usual way for > resolving these other than learning C and looking in the source code? Reading the CERT advisories. I have attached the one about popper below; it also contains information on how to get the CERT advisories. There was also an advisory about imapd yesterday, BTW. And, yes, I already have updated both popper and imapd. :-) Greetings, Juergen. -- Juergen Nickelsen Tellique Kommunikationstechnik GmbH Gustav-Meyer-Allee 25, 13355 Berlin, Germany Tel. +49 30 46307-552 / Fax +49 30 46307-579 -----BEGIN PGP SIGNED MESSAGE----- CERT* Advisory CA-98.08 Original issue date: July 14, 1998 Topic: Buffer overflows in some POP servers - ----------------------------------------------------------------------------- The CERT Coordination Center has received reports of buffer overflows in some Post Office Protocol (POP) servers. For a list of vulnerable versions and platforms, please refer to Appendix A. For help in determining which version you are currently running, see Section III.A below. The CERT/CC team recommends that anyone running a vulnerable version of this software upgrade to the current vendor-recommended version. Until you can do so, we suggest disabling the POP server. We will update this advisory as we receive additional information. Please check our advisory files regularly for updates that relate to your site. - ----------------------------------------------------------------------------- I. Description The CERT Coordination Center has received reports of buffer overflow vulnerabilities in some POP servers based on QUALCOMM's qpopper. Qpopper is a Post Office Protocol (POP) server used for downloading Internet e-mail. Information about this vulnerability has been posted to various mailing lists and newsgroups, and the CERT Coordination Center has received reports of incidents in which this vulnerability has been exploited to gain privileged access. II. Impact Remote users can gain privileged (root) access to systems running vulnerable versions of POP servers. III. Solution If you determine that your POP server is vulnerable (Sec. A), install a patch from your vendor. Until you can do so, we urge you to disable the POP server. A. Determine if your version of the POP server is vulnerable. To determine if a system is vulnerable, first telnet to port 110 on that host. If it is running a POP server, the banner will show the version. For example: % telnet yourmailhost.your.domain.com 110 Trying 123.123.123.123 Connected to mailhost +OK QPOP (version 2.4) at yourmailhost.your.domain.com starting In the above example, the POP server is QUALCOMM's QPopper, version 2.4, which is known to be a vulnerable version. Check Appendix A to see if your vendor has identified other POP server versions that are vulnerable. If you do not see your vendor's name, please contact the vendor directly. B. Install a patch for this problem. Appendix A contains input from vendors who have provided information for this advisory. C. Workaround If you are unable to upgrade to a version that is not vulnerable, we urge you to disable the POP server until you are able to address the problem. (This will, of course, mean that the functionality provided by the POP server will not be available.) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Appendix A - Vendor Information Below is a list of the vendors who have provided information for this advisory. We will update this appendix as we receive additional information. If you do not see your vendor's name, the CERT/CC did not hear from that vendor. Please contact the vendor directly. Data General - ------------ Data General does not ship qpopper, or any other POP client or server. Fujitsu - ------- The vulnerability described in this advisory is currently being reviewed. OpenBSD - ------- OpenBSD does not ship qpopper. QUALCOMM Incorporated - --------------------- Versions of QUALCOMM qpopper prior to 2.5 are vulnerable. QUALCOMM recommends upgrading to the most recent version (currently Version 2.52). Patches are available from ftp://ftp.qualcomm.com/Eudora/servers/unix/popper Further details, questions and comments should be sent to . Santa Cruz Operation, Inc. - -------------------------- Some SCO Operating systems are vulnerable. Patches are currently being developed and should be available soon. - ----------------------------------------------------------------------------- The CERT Coordination Center thanks Travis Mikalson at TerraNovaNet, Inc., for reporting the vulnerability, and Laurence Lundblade at QUALCOMM Incorporated for providing technical details and support in the development of the advisory. We also acknowledge other members of the Internet community who posted about this problem. - ----------------------------------------------------------------------------- If you believe that your system has been compromised, contact the CERT Coordination Center or your representative in the Forum of Incident Response and Security Teams (see http://www.first.org/team-info/). CERT/CC Contact Information - ---------------------------- Email cert@cert.org Phone +1 412-268-7090 (24-hour hotline) CERT personnel answer 8:30-5:00 p.m. EST(GMT-5) / EDT(GMT-4) and are on call for emergencies during other hours. Fax +1 412-268-6989 Postal address CERT Coordination Center Software Engineering Institute Carnegie Mellon University Pittsburgh PA 15213-3890 USA Using encryption We strongly urge you to encrypt sensitive information sent by email. We can support a shared DES key or PGP. Contact the CERT/CC for more information. Location of CERT PGP key ftp://ftp.cert.org/pub/CERT_PGP.key Getting security information CERT publications and other security information are available from http://www.cert.org/ ftp://ftp.cert.org/pub/ CERT advisories and bulletins are also posted on the USENET newsgroup comp.security.announce To be added to our mailing list for advisories and bulletins, send email to cert-advisory-request@cert.org In the subject line, type SUBSCRIBE your-email-address - --------------------------------------------------------------------------- Copyright 1998 Carnegie Mellon University. Conditions for use, disclaimers, and sponsorship information can be found in http://www.cert.org/legal_stuff/legal_stuff.html and ftp://ftp.cert.org/pub/legal_stuff . If you do not have FTP or web access, send mail to cert@cert.org with "copyright" in the subject line. *CERT is registered in the U.S. Patent and Trademark Office. - --------------------------------------------------------------------------- This file: ftp://ftp.cert.org/pub/cert_advisories/CA-98.08.qpopper_vul http://www.cert.org/nav/alerts.html ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Revision history -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBNatWFnVP+x0t4w7BAQHhvAP+NSgN4Uvg6wZxBLssDkR8tlT+cCfZq2mj 0/z1bGV4tzXsXcJsibOIiTm/grQjm/KgWGel4eDskkRv2pyjzc/2UepFUkAwBeMB GtRWVUmyYmxi4pN96QbS/xiqBPNdVVVTnnMYt1xhaiSXFZlQn4tlYKIhLNPv2GSa 4BRqHksrvII= =ySU9 -----END PGP SIGNATURE----- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message