Eric S. Raymond Fetchmail Message Count IMAP存在缓冲溢出发布时间：2002-05-24 更新时间：2002-05-24 严重程度：中 威胁程度：远程拒绝服务 错误类型：边界检查错误 利用方式：客户机模式 BUGTRAQ ID：4788 受影响系统 Eric Raymond Fetchmail 5.8.16详细描述 Fetchmail是免费开放源代码邮件获取工具。 当接收到IMAP服务器的时候，fetchmail会分配数组来存储信息的大小，此数组大小依靠服务器声称有多少信息决定，由于没有检查服务器声称的信息有多大，所以恶意IMAP服务器可导致fetchmail分配过多内存，产生拒绝服务。 测试代码 尚无 解决方案 Hewlett-Packard建议用户下载安装Red Hat Security Advisory RHSA-2002:047中的RPM包。 升级程序下载： Eric Raymond Fetchmail 5.8.16: Eric Raymond Fetchmail 5.8.17: Eric Raymond Upgrade fetchmail-5.9.10.tar.gz http://tuxedo.org/~esr/fetchmail/fetchmail-5.9.10.tar.gz Eric Raymond Fetchmail 5.9.1: Eric Raymond Upgrade fetchmail-5.9.10.tar.gz http://tuxedo.org/~esr/fetchmail/fetchmail-5.9.10.tar.gz Eric Raymond Fetchmail 5.9.2: Eric Raymond Upgrade fetchmail-5.9.10.tar.gz http://tuxedo.org/~esr/fetchmail/fetchmail-5.9.10.tar.gz Eric Raymond Fetchmail 5.9.3: Eric Raymond Upgrade fetchmail-5.9.10.tar.gz http://tuxedo.org/~esr/fetchmail/fetchmail-5.9.10.tar.gz Eric Raymond Fetchmail 5.9.4: Eric Raymond Upgrade fetchmail-5.9.10.tar.gz http://tuxedo.org/~esr/fetchmail/fetchmail-5.9.10.tar.gz Eric Raymond Fetchmail 5.9.5: Eric Raymond Upgrade fetchmail-5.9.10.tar.gz http://tuxedo.org/~esr/fetchmail/fetchmail-5.9.10.tar.gz Eric Raymond Fetchmail 5.9.6: Eric Raymond Upgrade fetchmail-5.9.10.tar.gz http://tuxedo.org/~esr/fetchmail/fetchmail-5.9.10.tar.gz Eric Raymond Fetchmail 5.9.7: Eric Raymond Upgrade fetchmail-5.9.10.tar.gz http://tuxedo.org/~esr/fetchmail/fetchmail-5.9.10.tar.gz Eric Raymond Fetchmail 5.9.8: Eric Raymond Upgrade fetchmail-5.9.10.tar.gz http://tuxedo.org/~esr/fetchmail/fetchmail-5.9.10.tar.gz Eric Raymond Fetchmail 5.9.9: Eric Raymond Upgrade fetchmail-5.9.10.tar.gz http://tuxedo.org/~esr/fetchmail/fetchmail-5.9.10.tar.gz Red Hat RPM fetchmail-5.9.0-10.alpha.rpm ftp://updates.redhat.com/7.0/en/os/alpha/fetchmail-5.9.0-10.alpha.rpm Red Hat RPM fetchmail-5.9.0-10.alpha.rpm ftp://updates.redhat.com/7.1/en/os/alpha/fetchmail-5.9.0-10.alpha.rpm Red Hat RPM fetchmail-5.9.0-10.i386.rpm ftp://updates.redhat.com/7.1/en/os/i386/fetchmail-5.9.0-10.i386.rpm Red Hat RPM fetchmail-5.9.0-10.i386.rpm ftp://updates.redhat.com/7.0/en/os/i386/fetchmail-5.9.0-10.i386.rpm Red Hat RPM fetchmail-5.9.0-10.ia64.rpm ftp://updates.redhat.com/7.1/en/os/ia64/fetchmail-5.9.0-10.ia64.rpm Red Hat RPM fetchmail-5.9.0-11.i386.rpm ftp://updates.redhat.com/7.2/en/os/i386/fetchmail-5.9.0-11.i386.rpm Red Hat RPM fetchmail-5.9.0-11.i386.rpm ftp://updates.redhat.com/7.3/en/os/i386/fetchmail-5.9.0-11.i386.rpm Red Hat RPM fetchmail-5.9.0-11.ia64.rpm ftp://updates.redhat.com/7.2/en/os/ia64/fetchmail-5.9.0-11.ia64.rpm Red Hat RPM fetchmail-5.9.0-9.alpha.rpm ftp://updates.redhat.com/6.2/en/os/alpha/fetchmail-5.9.0-9.alpha.rpm Red Hat RPM fetchmail-5.9.0-9.i386.rpm ftp://updates.redhat.com/6.2/en/os/i386/fetchmail-5.9.0-9.i386.rpm Red Hat RPM fetchmail-5.9.0-9.sparc.rpm ftp://updates.redhat.com/6.2/en/os/sparc/fetchmail-5.9.0-9.sparc.rpm Red Hat RPM fetchmailconf-5.9.0-10.alpha.rpm ftp://updates.redhat.com/7.0/en/os/alpha/fetchmailconf-5.9.0-10.alpha.rpm Red Hat RPM fetchmailconf-5.9.0-10.alpha.rpm ftp://updates.redhat.com/7.1/en/os/alpha/fetchmailconf-5.9.0-10.alpha.rpm Red Hat RPM fetchmailconf-5.9.0-10.i386.rpm ftp://updates.redhat.com/7.1/en/os/i386/fetchmailconf-5.9.0-10.i386.rpm Red Hat RPM fetchmailconf-5.9.0-10.i386.rpm ftp://updates.redhat.com/7.0/en/os/i386/fetchmailconf-5.9.0-10.i386.rpm Red Hat RPM fetchmailconf-5.9.0-10.ia64.rpm ftp://updates.redhat.com/7.1/en/os/ia64/fetchmailconf-5.9.0-10.ia64.rpm Red Hat RPM fetchmailconf-5.9.0-11.i386.rpm ftp://updates.redhat.com/7.2/en/os/i386/fetchmailconf-5.9.0-11.i386.rpm Red Hat RPM fetchmailconf-5.9.0-11.i386.rpm ftp://updates.redhat.com/7.3/en/os/i386/fetchmailconf-5.9.0-11.i386.rpm Red Hat RPM fetchmailconf-5.9.0-11.ia64.rpm ftp://updates.redhat.com/7.2/en/os/ia64/fetchmailconf-5.9.0-11.ia64.rpm Red Hat RPM fetchmailconf-5.9.0-9.alpha.rpm ftp://updates.redhat.com/6.2/en/os/alpha/fetchmailconf-5.9.0-9.alpha.rpm Red Hat RPM fetchmailconf-5.9.0-9.i386.rpm ftp://updates.redhat.com/6.2/en/os/i386/fetchmailconf-5.9.0-9.i386.rpm Red Hat RPM fetchmailconf-5.9.0-9.sparc.rpm ftp://updates.redhat.com/6.2/en/os/sparc/fetchmailconf-5.9.0-9.sparc.rpm 相关信息 参考：http://online.securityfocus.com/advisories/4145 http://online.securityfocus.com/advisories/4139 相关主页：http://www.tuxedo.org/~esr/fetchmail/ |
