Bugzilla – Bug 894999
VUL-0: procmail: CVE-2014-3618 procmail: Heap-overflow in procmail's formail utility when processing specially-crafted email headers
Last modified: 2014-10-13 13:00:08 UTC
via oss-sec/google zero team From: Tavis Ormandy <taviso@google.com> I noticed a heap overflow in procmail when parsing addresses with unbalanced quotes. I encountered this by accident when trying to organize a large usenet archive, this post to rec.arts.poems causes formail to crash. https://groups.google.com/forum/message/raw?msg=alt.arts.poetry.comments/DCuLO3qzovI/CZk15MlfqNkJ I've attached an mbox for reference. $ formail -s < mbox > /dev/null *** Error in `formail': free(): invalid next size (fast): 0x00007f103784a080 *** Segmentation fault (core dumped) $ rpm -q procmail procmail-3.22-33.fc20.x86_64 It looks like the fix is --- formisc.c 2013-08-04 00:13:33.000000000 -0700 +++ formisc.c 2014-09-03 11:42:25.986002396 -0700 @@ -84,12 +84,11 @@ case '"':*target++=delim='"';start++; } ;{ int i; - do + while(*start) if((i= *target++= *start++)==delim) /* corresponding delimiter? */ break; else if(i=='\\'&&*start) /* skip quoted character */ *target++= *start++; - while(*start); /* anything? */ } hitspc=2; } Tavis.
Created attachment 604929 [details] procmail-CVE-2014-3618.mbox reproducer mbox: $ formail -s < procmail-CVE-2014-3618.mbox > /dev/null *** Error in `formail': free(): invalid next size (fast): 0x00000000014451c0 *** Segmentation fault $
An update workflow for this issue was started. This issue was rated as important. Please submit fixed packages until 2014-09-11. When done, reassign the bug to security-team@suse.de. https://swamp.suse.de/webswamp/wf/58841
Affected packages: SLE-10-SP3-TERADATA: procmail SLE-11-SP3: procmail SLE-11-SP3-PRODUCTS: procmail SLE-11-SP3-UPTU: procmail
(please also fix SLE12, factory , 12.3 and 13.1)
This is an autogenerated message for OBS integration: This bug (894999) was mentioned in https://build.opensuse.org/request/show/247486 Factory / procmail
This is an autogenerated message for OBS integration: This bug (894999) was mentioned in https://build.opensuse.org/request/show/247491 Factory / procmail
SR#247491 - Factory SR#247528 - 12.3 SR#247529 - 13.1 SR#43580 - SLES-12 SR#43602 - SLES-11 SR#43601 - SLES-10
This is an autogenerated message for OBS integration: This bug (894999) was mentioned in https://build.opensuse.org/request/show/247528 12.3 / procmail https://build.opensuse.org/request/show/247529 13.1 / procmail
Fixed
This is an autogenerated message for OBS integration: This bug (894999) was mentioned in https://build.opensuse.org/request/show/247552 Factory / procmail https://build.opensuse.org/request/show/247553 12.3 / procmail https://build.opensuse.org/request/show/247555 13.1 / procmail
bugbot adjusting priority
openSUSE-SU-2014:1114-1: An update that fixes one vulnerability is now available. Category: security (important) Bug References: 894999 CVE References: CVE-2014-3618 Sources used: openSUSE 13.1 (src): procmail-3.22-264.6.1 openSUSE 12.3 (src): procmail-3.22-260.6.1
released
SUSE-SU-2014:1137-1: An update that fixes one vulnerability is now available. Category: security (important) Bug References: 894999 CVE References: CVE-2014-3618 Sources used: SUSE Linux Enterprise Server 11 SP3 for VMware (src): procmail-3.22-240.8.1 SUSE Linux Enterprise Server 11 SP3 (src): procmail-3.22-240.8.1 SUSE Linux Enterprise Desktop 11 SP3 (src): procmail-3.22-240.8.1
Can you create a fix for SLES11SP1?
we so far have not planned LTSS updates for this problem. you currently could request one as PTF.
This is an autogenerated message for OBS integration: This bug (894999) was mentioned in https://build.opensuse.org/request/show/255634 13.2 / procmail
This is an autogenerated message for OBS integration: This bug (894999) was mentioned in https://build.opensuse.org/request/show/255732 13.2 / procmail