Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 142386

Summary: dev-perl/net-server < 0.88 - format string vulnerability (CVE-2005-1127)
Product: Gentoo Security Reporter: Carsten Lohrke (RETIRED) <carlo>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Severity: normal CC: net-mail, perl, tcort
Priority: High    
Version: unspecified   
Hardware: All   
OS: Linux   
Whiteboard: B3 [glsa] jaervosz
Package list:
Runtime testing required: ---

Description Carsten Lohrke (RETIRED) gentoo-dev 2006-08-01 02:05:57 UTC
Format string vulnerability in the log function in Net::Server 0.87 and earlier, as used in Postfix Greylisting Policy Server (Postgrey) 1.18 and earlier, and possibly other products, allows remote attackers to cause a denial of service (crash) via format string specifiers that are not properly handled before being sent to syslog, as demonstrated using sender addresses to Postgrey.

So all needed is to remove <dev-perl/net-server-0.88 from the tree - if there were  not the problem with missing mips keyword in newer versions.
Comment 1 Sune Kloppenborg Jeppesen gentoo-dev 2006-08-01 02:22:30 UTC
Perl any particular version that is ready for stable marking? 0.93 is already stable on a couple of arches.
Comment 2 Michael Cummings (RETIRED) gentoo-dev 2006-08-04 06:14:51 UTC
i don't see any reason not to go with 0.94 - been almost a month, no direct bugs quoth the perl (not counting this one of course)
Comment 3 Michael Cummings (RETIRED) gentoo-dev 2006-08-04 06:18:12 UTC
though...this bug would just as easily be solved if we ~mips one of the later ebuilds, 0.88 is stable for all arch's except mips (which is only keyworded in older versions). just a thought, my personal opinion is that this isn't worth a gsla unless we have something forcing users to use 0.87 out there...?
Comment 4 Carsten Lohrke (RETIRED) gentoo-dev 2006-08-04 07:40:37 UTC
Michael, the point is that no user is forced to run --deep --update, so to make sure our users get the update, it's necessary either to send out a GLSA or to remove all earlier versions so the user sees the update. With regard to mips it's up to the mips team as mips is not a security-wise supported architecture. net-server-0.88 is of course fine as it is. I just did not look if removing the earlier mips keyworded version would break any other mips keyworded ebuild, so maybe KEYWORDS="-* ~mips" is needed. If the security team chooses to send out a GLSA, this would suffice as well, of course.
Comment 5 Michael Cummings (RETIRED) gentoo-dev 2006-08-06 06:45:53 UTC
understood :)

just let me know what you'd like perl herd to do, ebuild providing/keyword wise we're all set minus the mips stable in post 0.87.
Comment 6 Sune Kloppenborg Jeppesen gentoo-dev 2006-08-06 11:15:31 UTC
Arches please test and mark stable net-server 0.94 (any version > 0.88 will do).
Comment 7 Christian Faulhammer (RETIRED) gentoo-dev 2006-08-06 11:40:18 UTC
1) emerges fine, but I was surprised there was no message telling me that the test phase is entered, just went to the tests after
>>> Source compiled.
2) passes collision test
3) passes test suite

Portage 2.1-r1 (default-linux/x86/2006.0, gcc-3.4.6, glibc-2.3.6-r4, 2.6.17-gentoo-r4 i686)
System uname: 2.6.17-gentoo-r4 i686 AMD Athlon(tm) XP 2500+
Gentoo Base System version 1.6.15
app-admin/eselect-compiler: [Not Present]
dev-lang/python:     2.4.3-r1
dev-python/pycrypto: 2.0.1-r5
dev-util/ccache:     [Not Present]
dev-util/confcache:  [Not Present]
sys-apps/sandbox:    1.2.17
sys-devel/autoconf:  2.13, 2.59-r7
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2
sys-devel/binutils:  2.16.1-r3
sys-devel/gcc-config: 1.3.13-r3
sys-devel/libtool:   1.5.22
virtual/os-headers:  2.6.11-r2
CONFIG_PROTECT="/etc /usr/share/X11/xkb"
CONFIG_PROTECT_MASK="/etc/env.d /etc/gconf /etc/revdep-rebuild /etc/splash /etc/terminfo"
FEATURES="autoconfig ccache collision-protect distlocks metadata-transfer parallel-fetch sandbox sfperms strict test"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --delete-after --stats --timeout=180 --exclude='/distfiles' --exclude='/local' --exclude='/packages'"
USE="x86 3dnow 3dnowext X Xaw3d a52 alsa arts artworkextra asf audiofile avi bash-completion beagle berkdb bidi bitmap-fonts bootsplash branding bzip2 cairo cdda cddb cdparanoia cdr cli cracklib crypt css cups curl custom-cflags dbus dga directfb divx4linux dlloader dri dts dvd dvdr dvdread dvi eds emacs emboss encode esd evo exif expat fam fat fbcon fdftk ffmpeg firefox foomaticdb fortran ftp gb gcj gdbm gif gnome gpm gstreamer gtk gtk2 gtkhtml hal icq idn imagemagick imap imlib ipv6 isdnlog java javascript jikes jpeg jpeg2k ldap leim libg++ libwww lm_sensors mad maildir matroska mbox mikmod mime mmx mmxext mng mono motif mp3 mpeg mpeg2 mule nautilus ncurses nforce2 nls nocardbus nptl nptlonly nsplugin nvidia objc ogg opengl pam pcre pdf pdflib perl plotutils pmu png ppds pppd preview-latex print python qt qt3 qt4 quicktime readline reflection reiserfs samba sdk session slang spell spl sse ssl svg svga t1lib tcltk tcpd theora thunderbird tiff truetype truetype-fonts type1-fonts udev usb vcd videos vorbis win32codecs wmf wxwindows xine xml xorg xosd xv xvid zlib elibc_glibc input_devices_mouse input_devices_keyboard kernel_linux linguas_de userland_GNU video_cards_radeon video_cards_vesa video_cards_fbdev"
Comment 8 Michael Cummings (RETIRED) gentoo-dev 2006-08-06 12:02:54 UTC
amd64 and sparc done
Comment 9 Thomas Cort (RETIRED) gentoo-dev 2006-08-06 12:32:46 UTC
alpha stable.
Comment 10 Andrej Kacian (RETIRED) gentoo-dev 2006-08-06 14:31:18 UTC
x86 happy
Comment 11 Carsten Lohrke (RETIRED) gentoo-dev 2006-08-07 05:57:39 UTC
(In reply to comment #5)
> just let me know what you'd like perl herd to do, ebuild providing/keyword wise
> we're all set minus the mips stable in post 0.87.

Well, I don't mind if you act or the security team.

(In reply to comment #6)
> Arches please test and mark stable net-server 0.94 (any version > 0.88 will
> do).

No, 0.88 is fine as well; I wrote <0.88. It's just the question, if there will be a GLSA or if the earlier versions will be removed. In fact version 0.94 is problematic, since the current stable postgrey version has problems with it:

|* 2006-07-17: version 1.27
|   - fix socket permissions with Net::Server >= 0.94 (Leos Bitto)
Comment 12 Markus Rothe (RETIRED) gentoo-dev 2006-08-07 06:29:55 UTC
no postgrey available on ppc64, so not hitting the problem. 0.94 stable on ppc64
Comment 13 Raphael Marichez (Falco) (RETIRED) gentoo-dev 2006-08-07 06:48:00 UTC
mmm, i filled a GLSA request because it's "B1?", but execution of code doesn't seem possible according to .

i'd vote for crash only (but then i'd vote yes for glsa).
This may change the GLSA severity and the bug severity.
Comment 14 Carsten Lohrke (RETIRED) gentoo-dev 2006-08-07 07:48:31 UTC
(In reply to comment #12)
> no postgrey available on ppc64, so not hitting the problem. 0.94 stable on
> ppc64

Point is, this doesn't fix anything. Either removing older versions than 0.88 or a GLSA does.
Comment 15 Stefan Cornelius (RETIRED) gentoo-dev 2006-08-07 09:26:05 UTC
this one is ready for glsa. Currently, this seems to be more a B3 for me, since only DoS seems be the impact in the advisories I've seen abouot to this.

-> I tend to say no.
Comment 16 Tobias Scherbaum (RETIRED) gentoo-dev 2006-08-07 09:42:25 UTC
0.94 ppc stable
Comment 17 Sune Kloppenborg Jeppesen gentoo-dev 2006-08-07 09:47:51 UTC
Rerating and voting YES DoS.
Comment 18 René Nussbaumer (RETIRED) gentoo-dev 2006-08-08 02:12:44 UTC
stable on hppa
Comment 19 Sune Kloppenborg Jeppesen gentoo-dev 2006-08-10 05:19:54 UTC
Note that at least all recent amavisd-new users are safe from this one.
Comment 20 Sune Kloppenborg Jeppesen gentoo-dev 2006-08-10 13:15:37 UTC
GLSA 200608-18

ia64, mips don't forget to mark stable to benifit from the GLSA.
Comment 21 Peter Volkov (RETIRED) gentoo-dev 2008-03-06 09:40:54 UTC
Does not affect current (2008.0) release. Removing release.