Bug 38841

Summary:	qmail iso c patch
Product:	Gentoo Linux	Reporter:	Rajiv Aaron Manglani (RETIRED) <rajiv>
Component:	New packages	Assignee:	Net-Mail Packages <net-mail+disabled>
Status:	RESOLVED DUPLICATE
Severity:	enhancement
Priority:	Normal
Version:	1.4
Hardware:	All
OS:	All
URL:	http://www.jcb-sc.com/qmail/patches/qmail-isoc.patch
Whiteboard:
Package list:		Runtime testing required:	---

Description Rajiv Aaron Manglani (RETIRED) gentoo-dev

2004-01-20 13:35:50 UTC

should we include this patch with qmail?

Date: Mon, 19 Jan 2004 21:57:06 -0500
To: Serafino Sorrenti <ml@ssorrenti.com>
Cc: bugtraq@securityfocus.com
Subject: Re: Lame crash in qmail-smtpd and memory overwrite according to gdb,
	yet still qmail much better than windows
From: Scott Gifford <sgifford@suspectclass.com>

Serafino Sorrenti <ml@ssorrenti.com> writes:

> http://www.guninski.com/qmailcrash.html
> 
> 
> Georgi Guninski security advisory #65, 2004
> 
> Lame crash in qmail-smtpd and memory overwrite according to gdb, yet
> still qmail much better than windows
> 
> Systems affected:
> qmail 1.03 on linux, don't know about other OSes.
> 
> 
> Risk: Unknown. maybe so, maybe no.
> Date: 15 January 2004

We've had extensive discussion about this on the qmail list, and it
seems quite likely that this is not an exploitable bug.  The bug is a
signed integer wrapping from positive to negative and being used as an
array subscript.  Immediately after it wraps, qmail-smtpd references a
memory address which is way out-of-bounds and triggers SIGSEGV.  There
doesn't appear to be a way to cause a different subscript to be used
which would allow any real memory locations to be overwritten.

The apparent memory overwrite seems to be an artifact of a gdb bug,
and not a memory overwrite at all.  Only some people (not including
me) have been able to reproduce it, and nobody's been able to make
qmail actually execute anything fishy.  It sounds quite similar to the
gdb bug reported in Debian bug 154154:

    http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=154154

There are a number of very simple unofficial patches available.  The
fix is included with a few others in a patch by James Craig Burley,
which I've personally tested.  It's available at:

    http://www.jcb-sc.com/qmail/patches/qmail-isoc.patch

More information and discussion are available in the recent qmail list
archives:

    http://www.ornl.gov/lists/mailing-lists/qmail/2004/01/maillist.html

------ScottG.

Comment 1 Robin Johnson archtester

2004-01-20 14:56:38 UTC


*** This bug has been marked as a duplicate of 38304 ***