| Summary: | <mail-mta/netqmail-1.06-r13: multiple vulnerabilities (CVE-2005-{1513,1514,1515}) | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Thomas Deutschmann (RETIRED) <whissi> | ||||||||||
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> | ||||||||||
| Status: | RESOLVED FIXED | ||||||||||||
| Severity: | major | CC: | eike, powerman-asdf | ||||||||||
| Priority: | Normal | Flags: | nattka:
sanity-check+
|
||||||||||
| Version: | unspecified | ||||||||||||
| Hardware: | All | ||||||||||||
| OS: | Linux | ||||||||||||
| URL: | https://seclists.org/oss-sec/2020/q2/131 | ||||||||||||
| See Also: | https://github.com/gentoo/gentoo/pull/15881 | ||||||||||||
| Whiteboard: | B1 [glsa+ cve] | ||||||||||||
| Package list: |
mail-mta/netqmail-1.06-r13 arm ppc ppc64 x86
|
Runtime testing required: | --- | ||||||||||
| Attachments: |
|
||||||||||||
|
Description
Thomas Deutschmann (RETIRED)
2020-05-07 23:21:35 UTC
Created attachment 640170 [details, diff]
patch 1
Created attachment 640172 [details, diff]
patch 2
Created attachment 640174 [details, diff]
patch 3
Created attachment 640176 [details, diff]
patch 4
Ok, these 4 patches would be what I put into the next ebuild. Additionally I would switch the pop3 useflag to -pop3 so only those that actually need that beast will get it. Longterm idea is to switch that all to notqmail instead, where we will have even better patches shortly. The 2020 CVEs only affect the qmail-verify patch, which is not used by Gentoos ebuild. Now public. * CVE-2005-1513, CVE-2005-1514, CVE-2005-1515 These are the "classic" qmail RCE vulnerabilities. Please note that these are only _local_ exploits if you have not removed the softlimit line from the configuration. The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=3cd7e2b9721dbbf24cd4a5f9135236418a9c0cfa commit 3cd7e2b9721dbbf24cd4a5f9135236418a9c0cfa Author: Rolf Eike Beer <eike@sf-mail.de> AuthorDate: 2020-05-19 14:16:07 +0000 Commit: Thomas Deutschmann <whissi@gentoo.org> CommitDate: 2020-05-19 18:36:35 +0000 mail-mta/netqmail-1.06-r13: revbump for CVE-2005-1513, CVE-2005-1514, CVE-2005-1515 Bug: https://bugs.gentoo.org/721566 Signed-off-by: Rolf Eike Beer <kde@opensource.sf-tec.de> Closes: https://github.com/gentoo/gentoo/pull/15881 Signed-off-by: Thomas Deutschmann <whissi@gentoo.org> .../files/netqmail-1.06-CVE-2005-1513.patch | 66 ++++++ .../files/netqmail-1.06-CVE-2005-1514.patch | 39 ++++ .../files/netqmail-1.06-CVE-2005-1515.patch | 64 ++++++ .../netqmail/files/netqmail-1.06-overflows.patch | 223 +++++++++++++++++++++ mail-mta/netqmail/netqmail-1.06-r13.ebuild | 203 +++++++++++++++++++ 5 files changed, 595 insertions(+) Arches, please stabilize. ppc64 stable ppc stable arm stable x86 stable. Maintainer(s), please cleanup. Security, please add it to the existing request, or file a new one. The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=9748e68401dcb7e3059f3dc2640b770707b2d43a commit 9748e68401dcb7e3059f3dc2640b770707b2d43a Author: Rolf Eike Beer <eike@sf-mail.de> AuthorDate: 2020-06-04 06:55:22 +0000 Commit: Sergei Trofimovich <slyfox@gentoo.org> CommitDate: 2020-06-04 14:10:38 +0000 mail-mta/netqmail: drop vulnerable Bug: https://bugs.gentoo.org/721566 Signed-off-by: Rolf Eike Beer <eike@sf-mail.de> Signed-off-by: Sergei Trofimovich <slyfox@gentoo.org> mail-mta/netqmail/netqmail-1.06-r12.ebuild | 199 ----------------------------- 1 file changed, 199 deletions(-) This issue was resolved and addressed in GLSA 202007-01 at https://security.gentoo.org/glsa/202007-01 by GLSA coordinator Sam James (sam_c). |
