Bug 269123

Summary:

<net-mail/qmailadmin-1.2.15: Integer Overflow for user's quota

Product:

Gentoo Security

Reporter:

Stratos Psomadakis (RETIRED) <psomas>

Component:

Vulnerabilities

Assignee:

Gentoo Security <security>

Status:

RESOLVED FIXED

Severity:

minor

CC:

ago

Priority:

Normal

Version:

unspecified

Hardware:

All

OS:

All

URL:

http://www.securityfocus.com/archive/1/503375

Whiteboard:

B3 [noglsa]

Package list:

Runtime testing required:

---

Attachments:

Description	Flags
This patch preempts some potential integer overruns.	none

Description Stratos Psomadakis (RETIRED) gentoo-dev

2009-05-09 12:42:30 UTC

bug description here
http://www.securityfocus.com/archive/1/503375

Reproducible: Always

Comment 1 Stratos Psomadakis (RETIRED) gentoo-dev

2009-05-09 13:15:57 UTC

QmailAdmin is prone to several Integer Overflows due that
numeric types of more range are needed to store user's quota nowadays(quota over 2GB).

Comment 2 Mansour Moufid 2009-07-13 03:57:34 UTC

Created attachment 197747 [details, diff]
This patch preempts some potential integer overruns.

This patch doesn't fix the integer overrun mentioned in the advisory, but it's a start. Integer conversions now correctly detect and deal with some potential integer overruns in two functions.

Comment 3 Robin Johnson archtester

2011-01-26 01:49:42 UTC

I have merged your patch to 1.2.15 now.

Comment 4 Tim Sammut (RETIRED) gentoo-dev

2011-01-26 04:10:20 UTC

(In reply to comment #3)
> I have merged your patch to 1.2.15 now.
> 

Thank you.

Arches, please test and mark stable:
=net-mail/qmailadmin-1.2.15
Target keywords : "amd64 arm hppa ppc s390 sh sparc x86"

Comment 5 Kacper Kowalik (Xarthisius) (RETIRED) gentoo-dev

2011-01-26 09:07:48 UTC

ppc stable

Comment 6 Markos Chandras (RETIRED) gentoo-dev

2011-01-26 13:51:54 UTC

amd64 done

Comment 7 Christian Faulhammer (RETIRED) gentoo-dev

2011-01-26 19:52:05 UTC

x86 stable

Comment 8 Markus Meier gentoo-dev

2011-02-05 18:06:39 UTC

arm stable

Comment 9 Raúl Porcel (RETIRED) gentoo-dev

2011-02-12 17:52:38 UTC

s390/sh/sparc stable

Comment 10 Jeroen Roovers (RETIRED) gentoo-dev

2011-03-08 22:51:53 UTC

I don't see what's holding up people at bug #353073.

Comment 11 Jeroen Roovers (RETIRED) gentoo-dev

2011-05-24 15:32:35 UTC

There's going to be a point where this situation is untenable.

Comment 12 Jeroen Roovers (RETIRED) gentoo-dev

2012-06-18 23:25:43 UTC

Stable HPPA keywords dropped.

Comment 13 Agostino Sarubbo gentoo-dev

2012-06-19 08:32:59 UTC

@security: go ahead with the vote.

Comment 14 Tim Sammut (RETIRED) gentoo-dev

2012-06-19 11:47:51 UTC

Thanks, folks. This looks like a DoS only to me, but I could be wrong. GLSA Vote: no.

Comment 15 Sean Amoss (RETIRED) gentoo-dev

2012-07-10 22:22:04 UTC

Agreed, appears to be a DoS only.

GLSA vote: no.

Change noglsa.