[25201] in bugtraq
Re: Bug in QPopper (All Versions?)
daemon@ATHENA.MIT.EDU (Tim Jackson)
Sat Apr 20 16:51:51 2002
Date: Sat, 20 Apr 2002 14:18:42 +0100
From: Tim Jackson <tim@timj.co.uk>
To: bugtraq@securityfocus.com
Message-Id: <20020420141842.3861ee4b.tim@timj.co.uk>
In-Reply-To: <20020315015110.14475.qmail@mail.securityfocus.com>
Mime-Version: 1.0
Content-Type: multipart/signed; protocol="application/pgp-signature";
boundary="K_x6(dLNg=.QuJGc"
--K_x6(dLNg=.QuJGc
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
On 15 Mar 2002 01:51:10 -0000 Dustin Childers wrote:
> When sending a string that has 2048+ characters in it, the
> in.qpopper or popper process will begin to use massive
> amounts of CPU and will not stop until it is manually killed.
(BID 4295)
There has been no posting by the vendor here that I've seen, but from the
ChangeLog at ftp://ftp.qualcomm.com/eudora/servers/unix/popper/Changes :
"Changes from 4.0.3 to 4.0.4:
----------------------------
1. Fixed DOS attack seen on some systems."
which is presumably a reference to the same issue.
To confirm this, I did some tests on an Red Hat 7.2 i386 system. Results
are as follows:
Qpopper 4.0.3 (inetd mode via xinetd) - VULNERABLE
Qpopper 4.0.3 (standalone mode) - NOT TESTED
Qpopper 4.0.4 (inetd mode via xinetd) - NOT VULNERABLE
Qpopper 4.0.4 (standalone mode) - NOT VULNERABLE
If you want to install Qpopper as an RPM while you're updating it, you may
be interested in my RPM spec file, which can be found at
http://www.timj.co.uk/linux/ .
Tim
--
To assure privacy, you are encouraged to use strong encryption when
sending e-mail to me. PGP key at http://timj.co.uk/TimPubKey.asc
--K_x6(dLNg=.QuJGc
Content-Type: application/pgp-signature
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
iD8DBQE8wWq1gMfF5MXDbScRAtl+AKCbltJ3ab8gxgZ+bixJPDhz4APx0QCgi9Fx
wMuSY74auJuz87RL9Ug/DlM=
=2rbw
-----END PGP SIGNATURE-----
--K_x6(dLNg=.QuJGc--
