Re: ssmtp =2.62 unitialized memory disclosure

[Robert Buchholz <rbu () gentoo org>]

On Tuesday 09 September 2008, Robert Buchholz wrote:
> Hi,
>
> Maurice van der Pot of Gentoo reported a bug in ssmtp 2.62:
> The from_format() function in ssmtp.c will call strdup() on an
> unitialized memory if the user's gecos is unset and
> "FromLineOverride" is disabled in the configuration. This might
> disclose memory contents by sending them off in the the "From:" field
> of an email or cause a (client) crash.
>
> We're handling this as bug 234391 [ https://bugs.gentoo.org/234391 ].
> Patch: https://bugs.gentoo.org/attachment.cgi?id=165005
>
> ssmtp 2.61 is not affected.

As Tomas Hoger pointed out on IRC, 2.61 is affected as well -- I 
accidently checked our patched sources and not the vanilla tarball.
We added a patch to 2.61 in 2006, and accidently dropped it when bumping 
to 2.62.
Back then, this was bug 127592 [ https://bugs.gentoo.org/127592 ].

Thanks,
Robert

Attachment: signature.asc
Description: This is a digitally signed message part.