fetchmail denial of service in multibyte locales

[Matthias Andree]

Binary package hint: fetchmail

This is a draft of an upstream security announcement for fetchmail that also affects all versions ever shipped by Ubuntu, to be publicly released once the CVE name has been assigned (it is not yet, and has been requested via oss-security@).

Fixing this for Lucid should be highest priority, even before fixing shipping/supported releases such as Karmic.

http://gitorious.org/fetchmail/fetchmail/blobs/raw/master/fetchmail-SA-2010-02.txt (attached).

NOTE: The patch from the SA WILL NOT YIELD a working fetchmail copy in Ubuntu, because the base fetchmail version is older than 6.3.14.

This is also a showcase for the issue described in https://bugs.launchpad.net/ubuntu/+source/fetchmail/+bug/557467 that upgrading outdated packages will become ever harder over time.

[Matthias Andree (matthias-andree)]

The information is public already, no need to keep the Ubuntu copy private.

[Matthias Andree (matthias-andree)]

Can someone make this visible in the Lucid release series and assign an appropriate Importance please? Else it may be missed for 10.04 - and you don't want to ship vulnerable code, do you?

[Matthias Andree (matthias-andree)]

Note that I've had to change the patch as it missed one place in the code. I've reuploaded the new security announcement.

[Jamie Strandboge (jdstrand)]

This was fixed in 6.3.17-4ubuntu1.

[Matthias Andree (matthias-andree)]

wow, only three hours and one year (!) after the SA. :-( Seriously, this response time needs to improve massively.

[Jamie Strandboge (jdstrand)]

@Matthias: this was fixed a long time ago-- only the bug didn't get updated until yesterday.

[Matthias Andree (matthias-andree)]

Sorry for the misunderstanding.