ZRCSA-200505: libremail - "pop.c" Format String Vulnerability

[oudad mehdi <deepfear () gmail com>]

libremail - "pop.c" Format String Vulnerability

Zone-H Research Center Security Advisory 200505
http://www.zone-h.fr

Date of release: 16/12/2005
Software: libremail (http://libremail.tuxfamily.org/en/)
Affected versions: <= 1.1.0
Risk: Low/Medium
Discovered by: Mehdi Oudad "deepfear" from the Zone-H Research Team

Background
----------
libremail is a set of command line mail tools, it includes several
clients, and allows to filter mails.

from http://libremail.tuxfamily.org/en/trad.htm :
This web site is intended to present to you the whole part of
applications of electronic mail I developed.

These softwares functions under GNU/Linux and should normaly run
without any modification under the other UNIX systems.
On the other hand, I did not consider it useful (and a fortiori
priority) to adapt these applications to make them run also under
Windows.

Details
--------
There is a format string vulnerability in pop.c:

[...]
void lire_pop ()
{
    int posbuf;


    // initialisation
    posbuf = 0;

    // lecture jusqu'en fin de ligne ou de buffer
    do
        recv (sockfd, buf_lect + posbuf, 1, 0);
    while (buf_lect [posbuf++] != '\n' && posbuf < sz_buflect);

    // terminer la chaine de caractères lue (on supprime \r\n)
    if (posbuf > 1 && buf_lect [posbuf - 2] == '\r')
        buf_lect [posbuf - 2] = '\0';
    else
        buf_lect [posbuf - 1] = '\0';

#ifdef DEBUG
    putchar ('<');
    printf (buf_lect);
#endif
}

It could be exploited by tricking a user into connecting to a
malicious pop server, or by sending a malicious mail (if the user
reads it through a pop server), however it requires that debug mode is
activated (not default setting).

Solution
---------
The vendor has published updated sources:
http://libremail.tuxfamily.org/en/dersources.htm

They will also be included in an upcoming version (with other bugfixes
and new features).

--
Original advisories:
English version: Check Zone-H.org (off atm)
French: http://www.zone-h.fr/fr/advisories/read/id=733
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/