Netwosix Linux Security Advisory #2004-0002 <http://www.netwosix.org>;
Package name: fetchmail
Summary: remote denial of service
Date: 2004-02-20
Affected versions: Netwosix 1.0
Package description:
Fetchmail is a full-featured, robust, well-documented remote-mail
retrieval and forwarding utility intended to be used over on-demand
TCP/IP links (such as SLIP or PPP connections). It supports every
remote-mail protocol now in use on the Internet: POP2, POP3, RPOP,
APOP, KPOP, all flavors of IMAP, ETRN, and ODMR. It can even
support IPv6 and IPSEC.
Problem description:
Fetchmail 6.2.4 and earlier does not properly allocate memory for
long lines, which allows remote attackers to cause a denial of
service (crash) via a certain email.
Action:
We recommend that all systems with this package installed be
upgraded. Please note that if you do not need the functionality
provided by this package, you may want to remove it from your
system.
Location:
You can download the latest version of this package from: http://download.netwosix.org/0002/fetchmail-6.2.5.tar.gz
You can download the latest version of this package in NEPOTE
format from: http://download.netwosix.org/0002/nepote
Nepote Update:
See this instructions to update the port of this package:
# cd /usr/ports/sysutils/fetchmail/
# rm nepote
# wget http://download.netwosix.org/0002/nepote
References
Specific references for this advisory:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0792
About Linux Netwosix:
Linux Netwosix is a powerful and optimized Linux distribution for
servers and Network Security related jobs. It can also be used for
special operations such as penetration testing with its big
collection of security oriented software and sources. It’s a light
distribution created for the requirements of every SysAdmin and
it’s very portable and highly configurable. Our philosophy is to
give greater liberty for configuration to the SysAdmin. Only in
this way can he/she configure a powerful and stable server machine.
Linux Netwosix also has a powerful ports system (Nepote) similar to
the xBSD systems but more flexible and usable.
Questions?
Check out our mailing lists:
http://www.netwosix.org/mailing.html
The advisory itself is available at
http://www.netwosix.org/adv02.html
MD5sums of the packages:
101dc881d3bacc6970e4fe544b001d9f 0002/nepote
9956b30139edaa4f5f77c4d0dbd80225 0002/fetchmail-6.2.5.tar.gz
Netwosix Linux Security Advisory #2004-0003 <http://www.netwosix.org>;
Package name: linux kernel
Summary: Linux kernel do_mremap VMA limit local privilege
escalation vulnerability.
Date: 2004-02-20
Affected versions: Netwosix 1.0
Package description:
Linux Kernel. The core of the Linux Operative System.
Problem description:
Linux kernel do_mremap VMA limit local privilege escalation
vulnerability.
A critical security vulnerability has been found in the Linux
kernel memory management code inside the mremap(2) system call due
to missing function return value check. This bug is completely
unrelated to the mremap bug disclosed on 05-01-2004 except
concerning the same internal kernel function code.
Action:
Download the latest Linux Kernel (2.6.3) or use the patches
available from the Linux Kernel official site.
- http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.3.tar.bz2
- http://www.kernel.org/pub/linux/kernel/v2.6/patch-2.6.3.bz2
To build a new kernel:
Move your file into /usr/src and follow this instructions.
# tar xjf inux-2.6.3.tar.bz2
# cd /usr/src/linux-2.6.3
# make
# make modules
# make modules_install
# cp arch/i386/boot/bzImage /vmlinuz
# cp System.map /
To patch the kernel:
# mv patch-2.6.3.bz2 /usr/src/linux-2.6.1
# bzip2 -d patch-2.6.3.bz2
# patch -p1 < patch-2.6.3
# make
# make modules
# make modules_install
# cp arch/i386/boot/bzImage /vmlinuz
# cp System.map /
References
Specific references for this advisory:
http://www.isec.pl/vulnerabilities/isec-0014-mremap-unmap.txt
About Linux Netwosix:
Linux Netwosix is a powerful and optimized Linux distribution for
servers and Network Security related jobs. It can also be used for
special operations such as penetration testing with its big
collection of security oriented software and sources. It’s a light
distribution created for the requirements of every SysAdmin and
it’s very portable and highly configurable. Our philosophy is to
give greater liberty for configuration to the SysAdmin. Only in
this way can he/she configure a powerful and stable server machine.
Linux Netwosix also has a powerful ports system (Nepote) similar to
the xBSD systems but more flexible and usable.
Questions?
Check out our mailing lists:
http://www.netwosix.org/mailing.html
The advisory itself is available at
http://www.netwosix.org/adv03.html
Vincenzo Ciaglia – Linux Netwosix Security Advisories
ciaglia@netwosix.org –
http://www.netwosix.org