Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bugzilla DB migration completed. Please report issues to Infra team via email via infra@gentoo.org or IRC
Bug 397941 (CVE-2012-0070) - <mail-filter/spamdyke-4.2.1 "STARTTLS" Plaintext Injection Vulnerability (CVE-2012-0070)
Summary: <mail-filter/spamdyke-4.2.1 "STARTTLS" Plaintext Injection Vulnerability (CVE...
Status: RESOLVED FIXED
Alias: CVE-2012-0070
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: http://secunia.com/advisories/47435/#...
Whiteboard: B4 [noglsa]
Keywords:
Depends on:
Blocks: 397055
  Show dependency tree
 
Reported: 2012-01-06 22:54 UTC by Michael Harrison
Modified: 2012-01-20 08:33 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Michael Harrison 2012-01-06 22:54:17 UTC
The vulnerability is caused due to the TLS implementation not properly clearing transport layer buffers when upgrading from plaintext to ciphertext after receiving the "STARTTLS" command. This can be exploited to insert arbitrary plaintext data (e.g. SMTP commands) during the plaintext phase, which will then be executed after upgrading to the TLS ciphertext phase.

The vulnerability is reported in versions prior to 4.2.1.

Solution
Update to version 4.2.1.

Original Advisory:
http://www.spamdyke.org/documentation/Changelog.txt
Comment 1 Tupone Alfredo gentoo-dev 2012-01-15 13:48:41 UTC
version 4.2.1 is now in portage.
Comment 2 Sean Amoss gentoo-dev Security 2012-01-15 13:55:56 UTC
Thanks. 

Arches, please test and mark stable:
=mail-filter/spamdyke-4.2.1
Target KEYWORDS="amd64 x86"
Comment 3 Agostino Sarubbo gentoo-dev 2012-01-15 16:29:17 UTC
amd64 stable
Comment 4 Agostino Sarubbo gentoo-dev 2012-01-17 11:34:04 UTC
x86 stable.

@security: please vote.
Comment 5 Sean Amoss gentoo-dev Security 2012-01-17 11:49:19 UTC
Thanks, everyone. GLSA vote: no.
Comment 6 Agostino Sarubbo gentoo-dev 2012-01-17 23:02:14 UTC
(In reply to comment #4)
> @security: please vote.

Guys, before vote, just for your info, there is already a glsa request for this package ( bug 399157 )
Comment 7 Tim Sammut (RETIRED) gentoo-dev 2012-01-18 07:33:31 UTC
Thanks, everyone. GLSA Vote: no too, closing noglsa.