Bugzilla Bug 42133

PROGRAM: metamail
VENDOR: Bell Communications Research, Inc. (Bellcore)
DOWNLOAD URLs: ftp://thumper.bellcore.com/pub/nsb/
               http://ftp.funet.fi/pub/unix/mail/metamail/
VULNERABLE VERSIONS: 2.2, 2.4, 2.5, 2.6, 2.7, possibly others
IMMUNE VERSIONS: 2.7 with my patch applied
REFERENCES: CAN-2004-0104 (format string bugs)
            CAN-2004-0105 (buffer overflows)

http://lists.netsys.com/pipermail/full-disclosure/2004-February/017539.html

net-mail herd -- need a confirm/action on this.

netmail folks?

Confirmed : format string and buffer overflows :

http://www.kb.cert.org/vuls/id/518518
http://www.kb.cert.org/vuls/id/513062

Already published advisories include 
http://www.debian.org/security/2004/dsa-449

This package is not maintained upstream. We should either drop it or apply the latest Debian package patch :
http://security.debian.org/pool/updates/main/m/metamail/metamail_2.7-45woody.2.diff.gz

net-mail folks ?

-K

it's more than two months now - do you still read the forrester study? :)

net-mail was recently reorganized, so hopefully someone can take the metamail
package and bump the ebuild to the latest Debian patch (see comment above) ?

Thanks in advance,
-K

masking this package for security reasons.

geez

Hardmasking this packages leaves me with a broken portage:

it constantly complains about not having metamail ready since sylpheed-claws has a dep on it.
I don't want insecure software in portage either and don't have a solution for this as for now, but something like that should not happen!
I'll try to grab the source directly which I did for the last metamail-version I have on my system too because the genpatches just did not work.

You're welcome to submit an updated ebuild.  Otherwise, you can also unmask the
package as described in the /usr/portage/profiles/package.mask file.

I'm on this, give me a few minutes

Created an attachment (id=31204) [details]
ebuild using new debian patch

Jason, thanks for the ebuild -- I'd already had one in the works with a
different patch and a different tweak in it.  Anyway, people, 2.7.45.3 is in
portage -- Arch maintainers, please test and stabilise.

arches -- please test/mark stable.

Stable on alpha.

Are the automake and autoconf errors that show up right after the patch
expected?

 * Applying metamail_2.7-45.3.diff...                                     [ ok
]
ls: ./acinclude.m4: No such file or directory
automake: Makefile.am: required file `./NEWS' not found
automake: Makefile.am: required file `./AUTHORS' not found
automake: Makefile.am: required file `./ChangeLog' not found
FATAL ERROR: Autoconf version 2.50 or higher is required for this script
FATAL ERROR: Autoconf version 2.50 or higher is required for this script
>>> Source unpacked.

Once seemant's patch-fu was added, it now works great and spits out no errors.

Stable on sparc

When is the patched ebuild supposed to be supplied with the portage tree
officially - any schedule yet?
The masking still breaks emerge -u world when using sylpheed-claws.
How ca I apply the patch? sorry I

When is the patched ebuild supposed to be supplied with the portage tree
officially - any schedule yet?
The masking still breaks emerge -u world when using sylpheed-claws.
How ca I apply the patch? sorry I´m still n00b :-/

I just found http://www.gentoo.org/doc/en/portage-manual.xml#doc_chap3_sect2
again, so now I should be able to apply the fixed ebuild. 

Target keywords = "x86 ppc alpha ia64 sparc s390 ~amd64 ~hppa"
ppc, ia64, s390 : please mark stable

Stable on s390

ppc, ia64 : please mark stable

Marked ppc

GLSA 200405-17