[debian-users:33268] Bug#JP/1565: mnews: local and remote overflow vulnerabilities

[Tatsuya Kinoshita <tats@xxxxxxxxxx>]

Package: mnews
Version: 1.22PL4-2
Severity: critical

I saw the patch that fixes a security problem of FreeBSD's mnews:

  [ports-jp 12931] security fix: mnews
  http://home.jp.FreeBSD.org/cgi-bin/showmail/ports-jp/12931

Maybe woody-jp's mnews has the same problem.

In message [ports-jp 12931], on Tue, 4 Jun 2002,
Yoshihiko SARUMARU wrote:

| > I found security adovisory for mnews on bugtraq ML today.
| > I made a patch for this security problem and sent to author,
| > takuma-san about 10 hours before (but I have no answer from him
| > yet).

| > security adovisory:
| > http://archives.neohapsis.com/archives/bugtraq/2002-05/0287.html
| > 
| > exploit code:
| > http://archives.neohapsis.com/archives/bugtraq/2002-05/0296.html
| > 
| > --- tcplib/tcplib.c.orig	Fri Dec 17 02:27:36 1999
| > +++ tcplib/tcplib.c	Mon Jun  3 17:31:01 2002
| > @@ -498,7 +498,7 @@
| >    }
| >    buf[cnt] = '\0';
| >    fp->ptr = ptr;
| > -  fp->len = len;
| > +  fp->len = cnt;
| >    return(cnt);
| >  }
| >  #endif	/* !MSDOS */

In message http://archives.neohapsis.com/archives/bugtraq/2002-05/0287.html
on Fri, 31 May 2002, zillion wrote:

| Strategic Reconnaissance Team Security Advisory (SRT2002-04-31-1159)
| 
| Topic : Mnews local and remote overflow vulnerabilities
| Date : May 31, 2002
| Credit : zillion[at]safemode.org
| Site : http://www.snosoft.com

| .: Description:
| ---------------
| 
|  Mnews is a small console based email and news client which is often
|  installed setgid mail. Several local and remote overflows have been
|  identified in this package.
| 
|  Local overflows where found in the -f, -n, -D, -M, -P parameters and
|  in the JNAMES, MAILSERVER environment variables. The remote overflow
|  resides in the code responsible for processing responses received from
|  the NNTP server. For example the following response will result in an
|  overflow:
| 
|  200 <a x 770>
| 
|  If you look at the source code of mnews you will see that this package
|  is very outdated and dangerous to use on todays Internet.
| 
| .: Impact:
| ----------
| 
|  Local users might be able to elevate their privileges on the affected
|  systems. Remote malicious server owners can use mnews to penetrate an
|  affected system.
| 
|  We strongly recommend to stop using mnews.
| 
| .: Systems Affected:
| --------------------
| 
|  Systems running the mnews package version 1.22 are affected. It is
|  very likely that older versions are also affected.

-- 
Tatsuya Kinoshita