Merge lp:~ari-tczew/ubuntu/hardy/fetchmail/fix-CVE-2008-2711 into lp:ubuntu/hardy-security/fetchmail

[Artur Rona]

[Sebastien Bacher (seb128)]

changing to "work in progress" so it stops being on the sponsoring list since the bug states that issue is not worth a security upload to hardy

Unmerged revisions

24. By Artur Rona on 2010-04-01

* SECURITY UPDATE: Corrects a denial of service attack that can crash
  fetchmail when running in -v -v mode via malformed mail messages
  with long headers (LP: #240549)
  - debian/patches/07_fix_CVE-2008-2711_DoS.patch: Taken from intrepid
  - CVE-2008-2711

=== modified file 'debian/changelog'
--- debian/changelog	2009-08-11 12:03:52 +0000
+++ debian/changelog	2010-04-01 23:32:23 +0000
@@ -1,3 +1,13 @@
+fetchmail (6.3.8-10ubuntu1.2) hardy-security; urgency=low
+
+  * SECURITY UPDATE: Corrects a denial of service attack that can crash 
+    fetchmail when running in -v -v mode via malformed mail messages
+    with long headers (LP: #240549)
+    - debian/patches/07_fix_CVE-2008-2711_DoS.patch: Taken from intrepid
+    - CVE-2008-2711
+
+ -- Artur Rona <[e-mail]>  Fri, 02 Apr 2010 00:41:08 +0200
+
 fetchmail (6.3.8-10ubuntu1.1) hardy-security; urgency=low
 
   * SECURITY UPDATE: SSL cert validation bypass via NULL bytes.

=== added file 'debian/patches/07_fix_CVE-2008-2711_DoS.patch'
--- debian/patches/07_fix_CVE-2008-2711_DoS.patch	1970-01-01 00:00:00 +0000
+++ debian/patches/07_fix_CVE-2008-2711_DoS.patch	2010-04-01 23:32:23 +0000
@@ -0,0 +1,60 @@
+From: Michael Casadevall <[e-mail]>
+Description: CVE-2008-2711 - fetchmail 6.3.8 and earlier, when running in -v -v (aka verbose) mode, allows remote attackers to cause a denial of service (crash and persistent mail failure) via a malformed mail message with long headers, which triggers an erroneous dereference when using vsnprintf to format log messages.
+Origin: http://fetchmail.berlios.de/fetchmail-SA-2008-01.txt
+Bug: https://launchpad.net/bugs/240549
+Author: Matthias Andree 
+
+Index: fetchmail-6.3.8/report.c
+===================================================================
+--- fetchmail-6.3.8.orig/report.c	2008-10-21 08:22:29.000000000 -0400
++++ fetchmail-6.3.8/report.c	2008-10-21 08:24:50.000000000 -0400
+@@ -238,11 +238,17 @@
+     rep_ensuresize();
+ 
+ #if defined(VA_START)
+-    VA_START (args, message);
+     for ( ; ; )
+     {
++       /*
++        * args has to be initialized before every call of vsnprintf(),
++        * because vsnprintf() invokes va_arg macro and thus args is
++        * undefined after the call
++        */
++    VA_START (args, message);
+ 	n = vsnprintf (partial_message + partial_message_size_used, partial_message_size - partial_message_size_used,
+ 		       message, args);
++	va_end (args);
+ 
+ 	if (n >= 0
+ 	    && (unsigned)n < partial_message_size - partial_message_size_used)
+@@ -254,7 +260,6 @@
+ 	partial_message_size += 2048;
+ 	partial_message = REALLOC (partial_message, partial_message_size);
+     }
+-    va_end (args);
+ #else
+     for ( ; ; )
+     {
+@@ -304,12 +309,13 @@
+     rep_ensuresize();
+ 
+ #if defined(VA_START)
+-    VA_START (args, message);
+     for ( ; ; )
+     {
++    VA_START (args, message);
+ 	n = vsnprintf (partial_message + partial_message_size_used,
+ 		       partial_message_size - partial_message_size_used,
+ 		       message, args);
++	va_end (args);
+ 
+ 	/* old glibc versions return -1 for truncation */
+ 	if (n >= 0
+@@ -322,7 +328,6 @@
+ 	partial_message_size += 2048;
+ 	partial_message = REALLOC (partial_message, partial_message_size);
+     }
+-    va_end (args);
+ #else
+     for ( ; ; )
+     {

=== modified file 'debian/patches/series'
--- debian/patches/series	2009-08-11 12:03:52 +0000
+++ debian/patches/series	2010-04-01 23:32:23 +0000
@@ -3,3 +3,4 @@
 03_capa_probe.patch
 04_fix_CVE-2007-4565_DoS.patch
 06_cert_0_byte.patch
+07_fix_CVE-2008-2711_DoS.patch