Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Sun, 15 Jan 2012 15:48:17 +0100
From: Agostino Sarubbo <ago@...too.org>
To: oss-security@...ts.openwall.com
Subject: CVE Request for spamdyke "STARTTLS" Plaintext

In reference of: http://www.openwall.com/lists/oss-security/2012/01/07/1 :

According to secunia security advisory ( https://secunia.com/advisories/47435
 ) :

Description:
A vulnerability has been reported in spamdyke, which can be exploited by 
malicious people to manipulate certain data.

The vulnerability is caused due to the TLS implementation not properly 
clearing transport layer buffers when upgrading from plaintext to ciphertext 
after receiving the "STARTTLS" command. This can be exploited to insert 
arbitrary plaintext data (e.g. SMTP commands) during the plaintext phase, 
which will then be executed after upgrading to the TLS ciphertext phase.

The vulnerability is reported in versions prior to 4.2.1.


Solution:
Update to version 4.2.1.


And from upstream changelog ( 
http://www.spamdyke.org/documentation/Changelog.txt ):

 Changed smtp_filter() and middleman() to discard any buffered input after TLS
    is started.  This prevents the injection of commands into a secure session
    by sending extra input in the same packet as the "STARTTLS" command.  Not
    really a security problem but good practice anyway.  Thanks to Eric 
Shubert for reporting this one.


Sorry Kurt, but atm, I have not found the commit code.


-- 
Agostino Sarubbo		ago -at- gentoo.org
Gentoo/AMD64 Arch Security Liaison
GPG: 0x7CD2DC5D

Download attachment "signature.asc" of type "application/pgp-signature" (491 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.