3571e53040
patches for easier mirroring, to eliminate a special copy, to make www.freebsd.org/security a full copy of security.freebsd.org and be eventually be the same. For now files are just sitting there. The symlinks are missing. Discussed on: www (repository location) Discussed with: simon (so)
113 lines
4.1 KiB
Text
113 lines
4.1 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-00:07 Security Advisory
|
|
FreeBSD, Inc.
|
|
|
|
Topic: mh/nmh/exmh/exmh2 ports allow remote execution of binary code
|
|
|
|
Category: ports
|
|
Module: mh/nmh/exmh/exmh2
|
|
Announced: 2000-03-15
|
|
Revised: 2000-03-19
|
|
Affects: Ports collection before the correction date.
|
|
Corrected: [See below for a more complete description]
|
|
All versions fixed in 4.0-RELEASE.
|
|
mh: 2000-03-04
|
|
nmh: 2000-02-29
|
|
exmh: 2000-03-05
|
|
exmh2: 2000-03-05
|
|
FreeBSD only: NO
|
|
|
|
I. Background
|
|
|
|
MH and its successor NMH are popular Mail User Agents. EXMH and EXMH2 are
|
|
TCL/TK-based front-ends to the MH system. There are also Japanese-language
|
|
versions of the MH and EXMH2 ports, but these are developed separately and are
|
|
not vulnerable to the problem described here.
|
|
|
|
II. Problem Description
|
|
|
|
The mhshow command used for viewing MIME attachments contains a buffer
|
|
overflow which can be exploited by a specially-crafted email attachment,
|
|
which will allow the execution of arbitrary code as the local user when the
|
|
attachment is opened.
|
|
|
|
The *MH ports are not installed by default, nor are they "part of
|
|
FreeBSD" as such: they are part of the FreeBSD ports collection, which
|
|
contains over 3100 third-party applications in a ready-to-install
|
|
format. The FreeBSD 4.0-RELEASE ports collection is not vulnerable to
|
|
this problem.
|
|
|
|
FreeBSD makes no claim about the security of these third-party
|
|
applications, although an effort is underway to provide a security audit
|
|
of the most security-critical ports.
|
|
|
|
III. Impact
|
|
|
|
An attacker who can convince a user to open a hostile MIME attachment sent
|
|
as part of an email message can execute arbitrary binary code running with
|
|
the privileges of that user.
|
|
|
|
If you have not chosen to install any of the mh/nmh/exmh/exmh2
|
|
ports/packages, then your system is not vulnerable.
|
|
|
|
The Japanese-language version of MH is being actively developed and is
|
|
believed to have fixed this particular problem over a year ago. Consequently
|
|
the ja-mh and ja-exmh2 ports are not believed to be vulnerable to this problem.
|
|
|
|
IV. Workaround
|
|
|
|
1) Remove the mhshow binary, located in /usr/local/bin/mhshow. This will
|
|
prevent the viewing of MIME attachments from within *mh.
|
|
|
|
2) Remove the mh/nmh/exmh/exmh2 ports, if you you have installed them.
|
|
|
|
V. Solution
|
|
|
|
The English language version of the MH software is no longer actively
|
|
developed, and no fix is currently available. It is unknown whether a fix
|
|
to the problem will be forthcoming - consider upgrading to use NMH instead,
|
|
which is the designated successor of the MH software. EXMH and EXMH2 can
|
|
both be compiled to use NMH instead (this is now the default behaviour). It
|
|
is not necessary to recompile EXMH/EXMH2 after reinstalling NMH.
|
|
|
|
SOLUTION: Remove any old versions of the mail/mh or mail/nmh ports and
|
|
perform one of the following:
|
|
|
|
1) Upgrade your entire ports collection and rebuild the mail/nmh port.
|
|
|
|
2) Reinstall a new package obtained from:
|
|
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-3-stable/mail/nmh-1.0.3.tgz
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-current/mail/nmh-1.0.3.tgz
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/alpha/packages-4-current/mail/nmh-1.0.3.tgz
|
|
|
|
3) download a new port skeleton for the nmh port from:
|
|
|
|
http://www.freebsd.org/ports/
|
|
|
|
and use it to rebuild the port.
|
|
|
|
4) Use the portcheckout utility to automate option (3) above. The
|
|
portcheckout port is available in /usr/ports/devel/portcheckout or the
|
|
package can be obtained from:
|
|
|
|
ftp://ftp.freebsd.org/pub/FreeBSD/ports/packages/devel/portcheckout-1.0.tgz
|
|
|
|
VI. Revision history
|
|
|
|
v1.0 2000-03-15 Initial release
|
|
v1.1 2000-03-19 Update to note that the japanese-localized ports are not
|
|
vulnerable
|
|
|
|
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: 2.6.2
|
|
|
|
iQCVAwUBONXFXlUuHi5z0oilAQHQ/QP9FCTFiFlaeSv2ROM46PbDkF6MN39SLTuv
|
|
DEW6a6wmMU5+YbSTlFLjvYrqYgpjOmM7NMOMhhceVVpoZVMMPonHuJxHWh7YvF2G
|
|
T4bZcRM3kpRcjXAOQnIiUrgh77zoEmfBysAmHZbNucCmOB5y7UqHI3CM31+geiPR
|
|
/bsvHCy4U0U=
|
|
=Odcg
|
|
-----END PGP SIGNATURE-----
|