| Summary: |
VUL-0: CVE-2001-1487: Minor security problems in qpopper's popauth |
| Product: |
[Novell Products] SUSE Security Incidents
|
Reporter: |
Olaf Kirch <okir> |
| Component: |
Incidents | Assignee: |
Arvin Schnell <aschnell> |
| Status: |
RESOLVED
FIXED
|
QA Contact: |
Security Team bot <security-team> |
| Severity: |
Normal
|
|
|
| Priority: |
P3 - Medium
|
CC: |
security-team
|
| Version: |
unspecified | |
|
| Target Milestone: |
--- | |
|
| Hardware: |
All | |
|
| OS: |
Linux | |
|
| Whiteboard: |
CVE-2001-1487: CVSS v2 Base Score: 4.6 (AV:L/AC:L/Au:N/C:P/I:P/A:P) |
|
Found By:
|
Other
|
Services Priority:
|
|
|---|
|
Business Priority:
|
|
Blocker:
|
---
|
|---|
|
Marketing QA Status:
|
---
|
IT Deployment:
|
---
|
|---|
| Attachments: |
Patch for the bugs mentioned in the text
|
I found two security issues with popauth: - The -trace switch lets you write the debug log to any file owned by user pop. - The logit() function has subtle and possibly harmless buffer overflow because it thinks snprintf returns negative values when the buffer would overflow. However, it returns the number that would be written if the buffer were large enough. This makes the iLeft -= iChunk subtraction underflow, and iLeft will become a large positive number. Will attach patch.