AMaViS Security Announcement: AMaViS 0.1.x/0.2.x - all shell script versions using securetar (ASA-2002-2)
Rainer Link <[email protected]> Thu, 5 Sep 2002 09:52:29 +0200 (CEST)
| Newsgroups | gmane.mail.virus.amavis.user,gmane.mail.virus.amavis.announce |
|---|---|
| Message-ID | <[email protected]> |
This message is in MIME format. The first part should be readable text, while the remaining parts are likely unreadable without MIME-aware tools. Send mail to [email protected] for more info. --168427776-2067476121-1031212349=:10074 Content-Type: TEXT/PLAIN; charset=US-ASCII -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 =========================================================================== AMaViS Security Announcement Date: 09/03/2002 affected version(s): AMaViS-0.2.x, all amavis shell script versions amavis-perl/amavisd is _NOT_ affected Vulnerability Type: possible DoS attack by a special crafted TAR archive file Priority: urgent Solution: apply patch to securetar Author: Rainer Link <[email protected]> Advisory ID: ASA-2002-2 Contact: [email protected] - ---------------------------------------------------------------------------- 1. Problem description The AMaViS shell script version (AMaViS 0.1.x / 0.2.x) uses securetar. securetar removes the pathes of files in a tar archive and makes each file name a unique name. Links, character devices, block devices and named pipes will be removed from the archive. A special-crafted TAR file may hung securetar forever, using up to 100% CPU time. 2. Impact A DoS attack against the mail server may be possible. 3. Solution We strongly recommend to upgrade to amavis-perl/amavisd, as the development of AMaViS 0.2.x branch has been discontinued since July, 2001 (http://marc.theaimsgroup.com/?l=amavis-announce&m=99530451203949&w=2) If it's not possible to upgrade to amavis-perl/amavis, please apply the following patch to securetar, compile it and install the new securetar binary by overwriting the old one, i.e. /usr/local/src/amavis-0.2.1/src/securetar# patch -p3 < securetar.c.dif /usr/local/src/amavis-0.2.1/src/securetar# gcc -o securetar securetar.c /usr/local/src/amavis-0.2.1/src/securetar# cp -a securetar /usr/bin - --- amavis-0.2.1.orig/src/securetar/securetar.c Fri May 26 11:53:27 2000 +++ amavis-0.2.1/src/securetar/securetar.c Tue Sep 3 15:22:58 2002 @@ -231,8 +231,8 @@ /************************************/ /* Write out the corresponding data */ /************************************/ - - while( FileSize>0 ) { - - FileSize-=(long)count=read(fdin,&block,sizeof(block)); + while( FileSize>0 && (count=read(fdin,&block,sizeof(block))) ) { + FileSize-=(long)count; write( fdout, &block, count ); } } 4. Acknowledgement This bug was reported by Georgy Salnikov directly to me. 5. References http://www.amavis.org/ 6. Revision History 09/03/2002: Initial release =========================================================================== -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: Weitere Infos: siehe http://www.gnupg.org iD8DBQE9dwp8mxoFTBO0QHkRAnYMAJ4hycCIST5lZk9zN+0Th8c6JZ3QmQCgleoV UabDs0CJmavH5sjm4qcfKDI= =oQQz -----END PGP SIGNATURE----- -- Rainer Link | SuSE Linux AG - The Linux Experts [email protected] | Developer of A Mail Virus Scanner (www.amavis.org) www.suse.de | Founder OpenAntiVirus Project (www.openantivirus.org) --168427776-2067476121-1031212349=:10074 Content-Type: TEXT/PLAIN; charset=US-ASCII; name="securetar.c.dif" Content-Transfer-Encoding: BASE64 Content-ID: <[email protected]> Content-Description: Fix for securetar Content-Disposition: attachment; filename="securetar.c.dif" LS0tIGFtYXZpcy0wLjIuMS5vcmlnL3NyYy9zZWN1cmV0YXIvc2VjdXJldGFy LmMJRnJpIE1heSAyNiAxMTo1MzoyNyAyMDAwDQorKysgYW1hdmlzLTAuMi4x L3NyYy9zZWN1cmV0YXIvc2VjdXJldGFyLmMJVHVlIFNlcCAgMyAxNToyMjo1 OCAyMDAyDQpAQCAtMjMxLDggKzIzMSw4IEBADQogCQkvKioqKioqKioqKioq KioqKioqKioqKioqKioqKioqKioqKioqLw0KIAkJLyogV3JpdGUgb3V0IHRo ZSBjb3JyZXNwb25kaW5nIGRhdGEgKi8NCiAJCS8qKioqKioqKioqKioqKioq KioqKioqKioqKioqKioqKioqKiovDQotCQl3aGlsZSggRmlsZVNpemU+MCAp IHsNCi0JCQlGaWxlU2l6ZS09KGxvbmcpY291bnQ9cmVhZChmZGluLCZibG9j ayxzaXplb2YoYmxvY2spKTsNCisgICAgICAgICAgICAgICAgd2hpbGUoIEZp bGVTaXplPjAgJiYgKGNvdW50PXJlYWQoZmRpbiwmYmxvY2ssc2l6ZW9mKGJs b2NrKSkpICkgew0KKyAgICAgICAgICAgICAgICAgICAgICAgIEZpbGVTaXpl LT0obG9uZyljb3VudDsNCiAJCQl3cml0ZSggZmRvdXQsICZibG9jaywgY291 bnQgKTsNCiAJCX0NCiAJfQ0K --168427776-2067476121-1031212349=:10074-- ------------------------------------------------------- This sf.net email is sponsored by: OSDN - Tired of that same old cell phone? Get a new here for FREE! https://www.inphonic.com/r.asp?r=sourceforge1&refcode1=vs3390 _______________________________________________ AMaViS-user mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/amavis-user AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3