Bug 782532 – <net-libs/libesmtp-1.0.6_p20200824: Buffer overflow in NTLM handling (CVE-2019-19977)

• Status: IN_PROGRESS
• Product: Gentoo Security

[Description Sam James 2021-04-12 15:09:37 UTC]

Description:
"libESMTP through 1.0.6 mishandles domain copying into a fixed-size buffer in ntlm_build_type_2 in ntlm/ntlmstruct.c, as demonstrated by a stack-based buffer over-read."

Upstream bug: https://github.com/libesmtp/libESMTP/issues/6

[Comment 1 Larry the Git Cow 2021-04-12 15:50:13 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=43ecb1115b82b9d8c57165843da17e8ba3988fda

commit 43ecb1115b82b9d8c57165843da17e8ba3988fda
Author:     Sam James <[e-mail]>
AuthorDate: 2021-04-12 15:25:59 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2021-04-12 15:48:33 +0000

    net-libs/libesmtp: add 1.0.6_p20200824
    
    Includes various security fixes from upstream. Includes Meson port.
    
    A lot changed since the last release, so this is preferred
    to backporting for now.
    
    Bug: https://bugs.gentoo.org/782532
    Signed-off-by: Sam James <[e-mail]>

 net-libs/libesmtp/Manifest                        |  1 +
 net-libs/libesmtp/libesmtp-1.0.6_p20200824.ebuild | 37 +++++++++++++++++++++++
 net-libs/libesmtp/libesmtp-9999.ebuild            | 10 ++----
 3 files changed, 41 insertions(+), 7 deletions(-)

[Comment 2 Sam James 2021-04-12 15:54:23 UTC]

We need to let this sit for a little while, at least 2 weeks IMO.

[Comment 3 Sam James 2021-04-14 18:27:57 UTC]

https://github.com/libesmtp/libESMTP/issues/6#issuecomment-819696970

[Comment 4 Sam James 2021-06-07 15:57:20 UTC]

Adding esmtp, syslog-ng for fixes to find the newer libesmtp.

[Comment 5 Larry the Git Cow 2021-06-07 16:04:56 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=ee0daa88902a745674c5e346f75c7d10e52cf292

commit ee0daa88902a745674c5e346f75c7d10e52cf292
Author:     Sam James <[e-mail]>
AuthorDate: 2021-06-07 07:13:24 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2021-06-07 07:13:59 +0000

    net-libs/libesmtp: drop 1.0.6_p20200824
    
    Bug: https://bugs.gentoo.org/782532
    Signed-off-by: Sam James <[e-mail]>

 net-libs/libesmtp/Manifest                        |  1 -
 net-libs/libesmtp/libesmtp-1.0.6_p20200824.ebuild | 37 -----------------------
 2 files changed, 38 deletions(-)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=090649fefe0e649082041ec7c4a89a040a8fada4

commit 090649fefe0e649082041ec7c4a89a040a8fada4
Author:     Sam James <[e-mail]>
AuthorDate: 2021-06-07 07:13:19 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2021-06-07 07:13:57 +0000

    net-libs/libesmtp: add 1.1.0
    
    Bug: https://bugs.gentoo.org/782532
    Signed-off-by: Sam James <[e-mail]>

 net-libs/libesmtp/Manifest              |  1 +
 net-libs/libesmtp/libesmtp-1.1.0.ebuild | 36 +++++++++++++++++++++++++++++++++
 2 files changed, 37 insertions(+)

[Comment 6 Larry the Git Cow 2021-06-10 19:26:58 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=54b8aef1fbab2e718fe4a352a9b55e95ed26bf54

commit 54b8aef1fbab2e718fe4a352a9b55e95ed26bf54
Author:     Sam James <[e-mail]>
AuthorDate: 2021-06-10 19:25:54 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2021-06-10 19:25:54 +0000

    net-libs/libesmtp: increment subslot
    
    (See comment in ebuild.)
    
    Bug: https://bugs.gentoo.org/782532
    Signed-off-by: Sam James <[e-mail]>

 .../libesmtp/files/libesmtp-1.1.0-fix-soname.patch    | 19 +++++++++++++++++++
 ...libesmtp-1.1.0.ebuild => libesmtp-1.1.0-r1.ebuild} | 11 ++++++++++-
 2 files changed, 29 insertions(+), 1 deletion(-)

[Comment 7 Agostino Sarubbo 2021-06-17 07:23:09 UTC]

sparc stable

[Comment 8 Sam James 2021-06-17 20:18:36 UTC]

amd64 done

[Comment 9 Agostino Sarubbo 2021-06-18 06:28:08 UTC]

ppc stable

[Comment 10 Agostino Sarubbo 2021-06-18 06:29:03 UTC]

ppc64 stable

[Comment 11 Agostino Sarubbo 2021-06-18 06:30:17 UTC]

x86 stable

[Comment 12 Rolf Eike Beer 2021-07-02 14:57:41 UTC]

hppa done

[addCollapseLink(13, 1, 'Toggle comment display'); Comment 13 NATTkA bot 2021-07-05 23:36:29 UTC Comment hidden (obsolete)]

Unable to check for sanity:

> no match for package: app-admin/syslog-ng-3.30.1-r1

[Comment 14 Sam James 2021-07-17 04:59:50 UTC]

arm64 done

[Comment 15 Sam James 2021-07-17 04:59:52 UTC]

arm done

all arches done

[Comment 16 Sam James 2021-07-17 05:01:50 UTC]

Please cleanup, thanks!

[Comment 17 Larry the Git Cow 2021-07-26 03:24:59 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=00a184a68ba0372f2257b78735e7ec063cb8ff47

commit 00a184a68ba0372f2257b78735e7ec063cb8ff47
Author:     John Helmert III <[e-mail]>
AuthorDate: 2021-07-25 20:57:34 +0000
Commit:     John Helmert III <[e-mail]>
CommitDate: 2021-07-26 03:12:54 +0000

    net-libs/libesmtp: drop 1.0.6-r3
    
    Bug: https://bugs.gentoo.org/782532
    Signed-off-by: John Helmert III <[e-mail]>

 net-libs/libesmtp/Manifest                         |  1 -
 ...esmtp-1.0.6-openssl-1.1-api-compatibility.patch | 72 ----------------------
 net-libs/libesmtp/libesmtp-1.0.6-r3.ebuild         | 49 ---------------
 net-libs/libesmtp/metadata.xml                     |  3 -
 4 files changed, 125 deletions(-)

[Comment 18 NATTkA bot 2021-12-21 02:00:48 UTC]

Unable to check for sanity:

> no match for package: app-admin/syslog-ng-3.30.1-r2