Archive of CERT general posting, CERT Advisory CA-98.08 - qpopper_vul

15/07/98, CERT Advisory CA-98.08 - qpopper_vul
From: CERT Advisory <cert-advisory@cert.org>

Generated by MHonArc

CSIM Logo WelcomeCourses
Faculty, Student, Staff
Projects and reports
Conferences, workshop and seminars
Laboratories and reasearch facilities
Information related to CSIM
Information non-related to CSIM
Address, map, phone, etc.
Search

[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]


To: cert-advisory@coal.cert.org
Subject: CERT Advisory CA-98.08 - qpopper_vul
From: CERT Advisory <cert-advisory@cert.org>
Date: Tue, 14 Jul 1998 09:53:05 -0400
Organization: CERT(sm) Coordination Center - +1 412-268-7090
Reply-To: cert-advisory-request@cert.org

-----BEGIN PGP SIGNED MESSAGE-----

CERT* Advisory CA-98.08
Original issue date: July 14, 1998

Topic: Buffer overflows in some POP servers

- -----------------------------------------------------------------------------

The CERT Coordination Center has received reports of buffer overflows
in some Post Office Protocol (POP) servers. For a list of vulnerable
versions and platforms, please refer to Appendix A. For help in
determining which version you are currently running, see Section III.A
below.

The CERT/CC team recommends that anyone running a vulnerable version of this
software upgrade to the current vendor-recommended version. Until you can do
so, we suggest disabling the POP server.

We will update this advisory as we receive additional information. Please
check our advisory files regularly for updates that relate to your site.

- -----------------------------------------------------------------------------

I.  Description

The CERT Coordination Center has received reports of buffer overflow
vulnerabilities in some POP servers based on QUALCOMM's
qpopper. Qpopper is a Post Office Protocol (POP) server used for
downloading Internet e-mail.

Information about this vulnerability has been posted to various
mailing lists and newsgroups, and the CERT Coordination Center has
received reports of incidents in which this vulnerability has been
exploited to gain privileged access.


II. Impact

Remote users can gain privileged (root) access to systems running
vulnerable versions of POP servers.


III. Solution

     If you determine that your POP server is vulnerable (Sec. A),
     install a patch from your vendor. Until you can do so, we urge you to
     disable the POP server.

     A. Determine if your version of the POP server is vulnerable.

         To determine if a system is vulnerable, first telnet to port 110 on
         that host. If it is running a POP server, the banner will show the
         version. For example:

               % telnet yourmailhost.your.domain.com 110
               Trying 123.123.123.123
               Connected to mailhost
               +OK QPOP (version 2.4) at yourmailhost.your.domain.com starting

         In the above example, the POP server is QUALCOMM's QPopper,
         version 2.4, which is known to be a vulnerable version.

         Check Appendix A to see if your vendor has identified other POP
         server versions that are vulnerable. If you do not see your vendor's
         name, please contact the vendor directly.

     B. Install a patch for this problem.

         Appendix A contains input from vendors who have provided information
         for this advisory.

     C. Workaround

         If you are unable to upgrade to a version that is not vulnerable,
         we urge you to disable the POP server until you are able to address
         the problem. (This will, of course, mean that the functionality
         provided by the POP server will not be available.)



~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Appendix A - Vendor Information

Below is a list of the vendors who have provided information for this
advisory. We will update this appendix as we receive additional information.
If you do not see your vendor's name, the CERT/CC did not hear from that
vendor. Please contact the vendor directly.



Data General
- ------------
Data General does not ship qpopper, or any other POP client or server.


Fujitsu
- -------
The vulnerability described in this advisory is currently being
reviewed.


OpenBSD
- -------
OpenBSD does not ship qpopper.


QUALCOMM Incorporated
- ---------------------
Versions of QUALCOMM qpopper prior to 2.5 are vulnerable.
QUALCOMM recommends upgrading to the most recent version
(currently Version 2.52). Patches are available from

         ftp://ftp.qualcomm.com/Eudora/servers/unix/popper

Further details, questions and comments should be sent to
<mailto:qpopper@qualcomm.com>.


Santa Cruz Operation, Inc.
- --------------------------
Some SCO Operating systems are vulnerable. Patches are currently
being developed and should be available soon.

- -----------------------------------------------------------------------------

The CERT Coordination Center thanks Travis Mikalson at TerraNovaNet,
Inc., for reporting the vulnerability, and Laurence Lundblade at
QUALCOMM Incorporated for providing technical details and support in the
development of the advisory. We also acknowledge other members of the
Internet community who posted about this problem.

- -----------------------------------------------------------------------------

If you believe that your system has been compromised, contact the CERT
Coordination Center or your representative in the Forum of Incident Response
and Security Teams (see http://www.first.org/team-info/).


CERT/CC Contact Information
- ----------------------------
Email    cert@cert.org

Phone    +1 412-268-7090 (24-hour hotline)
                CERT personnel answer 8:30-5:00 p.m. EST(GMT-5) / EDT(GMT-4)
                and are on call for emergencies during other hours.

Fax      +1 412-268-6989

Postal address
         CERT Coordination Center
         Software Engineering Institute
         Carnegie Mellon University
         Pittsburgh PA 15213-3890
         USA

Using encryption
   We strongly urge you to encrypt sensitive information sent by email. We can
   support a shared DES key or PGP. Contact the CERT/CC for more information.
   Location of CERT PGP key
         ftp://ftp.cert.org/pub/CERT_PGP.key

Getting security information
   CERT publications and other security information are available from
        http://www.cert.org/
        ftp://ftp.cert.org/pub/

   CERT advisories and bulletins are also posted on the USENET newsgroup
        comp.security.announce

   To be added to our mailing list for advisories and bulletins, send
   email to
        cert-advisory-request@cert.org
   In the subject line, type
        SUBSCRIBE  your-email-address

- ---------------------------------------------------------------------------

Copyright 1998 Carnegie Mellon University. Conditions for use, disclaimers,
and sponsorship information can be found in
http://www.cert.org/legal_stuff/legal_stuff.html and
ftp://ftp.cert.org/pub/legal_stuff .
If you do not have FTP or web access, send mail to cert@cert.org with
"copyright" in the subject line.

*CERT is registered in the U.S. Patent and Trademark Office.

- ---------------------------------------------------------------------------

This file: ftp://ftp.cert.org/pub/cert_advisories/CA-98.08.qpopper_vul
           http://www.cert.org/nav/alerts.html



~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Revision history

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBNatWFnVP+x0t4w7BAQHhvAP+NSgN4Uvg6wZxBLssDkR8tlT+cCfZq2mj
0/z1bGV4tzXsXcJsibOIiTm/grQjm/KgWGel4eDskkRv2pyjzc/2UepFUkAwBeMB
GtRWVUmyYmxi4pN96QbS/xiqBPNdVVVTnnMYt1xhaiSXFZlQn4tlYKIhLNPv2GSa
4BRqHksrvII=
=ySU9
-----END PGP SIGNATURE-----



Previous message sorted by date: CERT Advisory CA-98.07 - PKCS
Next message sorted by date: CERT Advisory CA-98.09 - imapd
Previous message sorted by thread: CERT Advisory CA-98.07 - PKCS
Next message by thread: CERT Advisory CA-98.09 - imapd
Main Index
Thread Index

CSIM home pageWMailAccount managementCSIM LibraryNetwork test toolsSearch CSIM directories
Contact us: Olivier Nicole CSIM    SET    AIT Last update: Feb 2000