Bug 81521 (CVE-2005-1152)

Date: Wed, 27 Apr 2005 16:07:21 +0200
From: Martin Schulze <joey@infodrom.org>
To: Free Software Distribution Vendors <vendor-sec@lst.de>
Subject: [vendor-sec] CAN-2005-1151/2: Problems in qpopper
Parts/Attachments:
   1.1 Shown    ~24 lines  Text
   1.2   OK    ~178 lines  Text
   1.3   OK     ~29 lines  Text
   2            196 bytes  Application, "Digital signature"
----------------------------------------

Two bugs have been discovered in qpopper, an enhanced Post Office
Protocol (POP3) server.  The Common Vulnerability and Exposures
project identifies the following problems:

CAN-2005-1151

    Jens Steube discovered that while processing local files owned or
    provided by a normal user privileges weren't dropped, which could
    lead to the overwriting or creation of arbitrary files as root.

CAN-2005-1152

    The upstream developers noticed that qpopper could be tricked to
    creating group- or world-writable files.

I'm attaching patches for both.

Regards,

       Joey