[CVE-2008-1648] denial of service via crafted Content-Type header

[William Grant]

Binary package hint: sympa

It's likely that all releases are affected.

CVE-2008-1648:
"Sympa before 5.4 allows remote attackers to cause a denial of service (daemon crash) via an e-mail message with a malformed value of the Content-Type header and unspecified other headers. NOTE: some of these details are obtained from third party information."

[Emanuele Gentili (emgent)]

ubuntu-universe-sponsor subscribed for hardy upload.

[Scott Kitterman (kitterman)]

motu-release ack for Hardy.

[Launchpad Janitor (janitor)]

This bug was fixed in the package sympa - 5.3.4-2ubuntu2

---------------
sympa (5.3.4-2ubuntu2) hardy; urgency=low

  * SECURITY UPDATE: (LP: #216591)
   + fixed src/PlainDigest.pm inline
    - Sympa before 5.4 allows remote attackers to cause a denial of
      service (daemon crash) via an e-mail message with a malformed
      value of the Content-Type header and unspecified other headers.
      NOTE: some of these details are obtained from third party
      information.
  * References
   + http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2008-1648
   + http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=475163

 -- Emanuele Gentili <email address hidden> Mon, 14 Apr 2008 08:44:38 +0200

[Hew (hew)]

Ubuntu Edgy Eft is no longer supported, so a SRU will not be issued for this release. Marking Edgy as Won't Fix.

[Jamie Strandboge (jdstrand)]

Thanks for the gutsy debdiff! Can you post your testing for gutsy? Once that is done I can push these out.

[Emanuele Gentili (emgent)]

Fix synced by debian.

POC available here:
http://sourcesup.cru.fr/tracker/?func=detail&group_id=23&aid=3702&atid=167

Tested on gutsy x86.

[LumpyCustard (orangelumpycustard)]

Please close for Feisty as Won't Fix? This goes for all the other Feisty bugs.

[Jamie Strandboge (jdstrand)]

Thank you for reporting this bug to Ubuntu. dapper has reached EOL
(End of Life) and is no longer supported. As a result, this bug
against dapper is being marked "Won't Fix". Please see
https://wiki.ubuntu.com/Releases for currently supported Ubuntu
releases.

Please feel free to report any other bugs you may find.