Original issue date: July 14, 1998<BR>
Last revised: August 24, 1998<BR>
Added vendor information for Silicon Graphics Inc.
<P>A complete revision history is at the end of this file.
<P>The CERT Coordination Center has received reports of buffer
overflows in some Post Office Protocol (POP) servers. For a list of
vulnerable versions and platforms, please refer to Appendix A. For
help in determining which version you are currently running, see
Section III.A below.
<P>The CERT/CC team recommends that anyone running a vulnerable
version of this software upgrade to the current vendor-recommended
version. Until you can do so, we suggest disabling the POP server.
<P>We will update this advisory as we receive additional
information. Please check our advisory files regularly for updates
that relate to your site.
<P><HR>
<P>
<H2>I. Description</H2>
<P>The CERT Coordination Center has received reports of buffer
overflow vulnerabilities in some POP servers based on QUALCOMM's
qpopper. Qpopper is a Post Office Protocol (POP) server used for
downloading Internet e-mail.
<P>Information about this vulnerability has been posted to various
mailing lists and newsgroups, and the CERT Coordination Center has
received reports of incidents in which this vulnerability has been
exploited to gain privileged access.
<H2>II. Impact</H2>
<P>Remote users can gain privileged (root) access to systems running
vulnerable versions of POP servers.
<H2>III. Solution</H2>
<P>If you determine that your POP server is vulnerable (Sec. A),
install a patch from your vendor. Until you can do so, we urge you to
disable the POP server.
<P>
<OL>
<H3><LI TYPE="A">Determine if your version of the POP server is
vulnerable.</H3>
<P>To determine if a system is vulnerable, first telnet to port 110 on
that host. If it is running a POP server, the banner will show the
version. For example:
<P>
<PRE>
% telnet yourmailhost.your.domain.com 110
Trying 123.123.123.123
Connected to mailhost
+OK QPOP (version 2.4) at yourmailhost.your.domain.com starting
</PRE>
<P>In the above example, the POP server is QUALCOMM's QPopper,
version 2.4, which is known to be a vulnerable version.
<P>Check Appendix A to see if your vendor has identified other POP
server versions that are vulnerable. If you do not see your vendor's
name, please contact the vendor directly.
<P>
<H3><LI>Install a patch for this problem.</H3>
<P>Appendix A contains input from vendors who have provided information
for this advisory.
<P>
<H3><LI>Workaround</H3>
<P>If you are unable to upgrade to a version that is not vulnerable,
we urge you to disable the POP server until you are able to address
the problem. (This will, of course, mean that the functionality
provided by the POP server will not be available.)
<P></OL>
<HR>
<P>
<H1>Appendix A - Vendor Information</H1>
<P>Below is a list of the vendors who have provided information for
this advisory. We will update this appendix as we receive additional
information. If you do not see your vendor's name, the CERT/CC did
not hear from that vendor. Please contact the vendor directly.
<P>
<H4>Data General</H4>
<P><PRE>
Data General does not ship qpopper, or any other POP client or server.
</PRE>
<P>
<H4>Digital Equipment Corporation</H4>
<P><PRE>
Copyright 1994, 1995, 1996, 1997 Compaq Computer Corporation. All rights
reserved.
SOURCE: Compaq Computer Corporation
Compaq's Digital UNIX / ULTRIX
Software Security Response Team USA
This reported problem is not present for the as shipped,
Compaq's Digital ULTRIX or Compaq's Digital UNIX
Operating Systems Software.
</PRE>
<P>
<H4>Fujitsu</H4>
<P><PRE>
Fujitsu's UXP/V operating system does not support qpopper so we are not
affected by it.
</PRE>
<P>
<H4>OpenBSD</H4>
<P><PRE>
OpenBSD does not ship qpopper.
</PRE>
<P>
<H4>QUALCOMM Incorporated</H4>
<P><PRE>
Versions of QUALCOMM qpopper prior to 2.5 are vulnerable.
QUALCOMM recommends upgrading to the most recent version
(currently Version 2.52). Patches are available from
ftp://ftp.qualcomm.com/Eudora/servers/unix/popper
Further details, questions and comments should be sent to qpopper@qualcomm.com.
</PRE>
<P>
<H4>Santa Cruz Operation, Inc.</H4>
<P><PRE>
The following releases of SCO Operating Systems contain a version
of the Qualcomm popper that is vulnerable:
- - SCO OpenServer Releases 5.0.0, 5.0.2, 5.0.4
- - SCO Internet FastStart Releases 1.0, 1.1
The following SCO Operating Systems are not vulnerable,
- - SCO UnixWare 7
- - SCO UnixWare 2.1
- - SCO CMW+
- - SCO Open Desktop / Open Server 3.0, SCO UNIX 3.2v4
Binary versions of the patched popper will be available shortly
from the SCO ftp site:
ftp://ftp.sco.com/SSE/sse013.ltr - cover letter
ftp://ftp.sco.com/SSE/sse013.tar.Z - replacement binary
The fix includes binaries for the following SCO operating systems:
- - SCO OpenServer 5.0.0, 5.0.2, 5.0.4
- - SCO Internet FastStart Releases 1.0, 1.1
For the latest security bulletins and patches for SCO products,
please refer to http://www.sco.com/security/ .
</PRE>
<P>
<H4>Silicon Graphics Inc.</H4>
<P>Please refer to Silicon Graphics Inc. Security Advisory,
"BSD/Qualcomm qpopper Vulnerability," Number: 19980801-01-I,
distributed August 6, 1998 for additional information relating to this
vulnerability.
<P> The primary SGI anonymous FTP site for security information and
patches is sgigate.sgi.com (204.94.209.1). Security information and
patches are located under the directories ~ftp/security and
~ftp/patches, respectively. The Silicon Graphics Security Headquarters
Web page is accessible at the URL
<A HREF="http://www.sgi.com/Support/security/security.html">
http://www.sgi.com/Support/security/security.html</A>.
<HR>
<P>The CERT Coordination Center thanks Travis Mikalson at
TerraNovaNet, Inc., for reporting the vulnerability, and Laurence
Lundblade at QUALCOMM Incorporated for providing technical details and
support in the development of the advisory. We also acknowledge other
members of the Internet community who posted about this problem.
<p><!--#include virtual="/include/footer_nocopyright.html" --> </p>
<p>Copyright 1998 Carnegie Mellon University.</p>
<HR>
Revision History
<PRE>
Aug. 24, 1998 Added vendor information for Silicon Graphics Inc.
July 22, 1998 Updated vendor information for Fujitsu and Santa
Cruz Operation, Inc.
July 14, 1998 Added vendor information for Digital Equipment Corporation.
</PRE>
|