Ubuntu
postfix-policyd package

buffer overflow in w_read function (possible DoS and execution of arbitary code)

Bug #136687 reported by Daniel Hahler
256
Affects Status Importance Assigned to Milestone
postfix-policyd (Ubuntu)
Fix Released
Undecided
Unassigned
Dapper
Invalid
Undecided
Daniel Hahler
Edgy
Invalid
Undecided
Daniel Hahler
Feisty
Fix Released
High
Kees Cook
Gutsy
Fix Released
Undecided
Daniel Hahler

Bug Description

Binary package hint: postfix-policyd

Theres a security issue with postfix-policyd, which needs to be fixed for Feisty.

See bug 132088 for the sync from Debian to Gutsy.

There are no ubuntu changes and the security fix is the only change from Debian.

Unfortunately, there appears to be a bug, which causes upgrades to fail (bug 91607), when postfix-policyd is already running.

CVE References

William Grant (wgrant)
Changed in postfix-policyd:
status: New → Fix Released
importance: Undecided → High
status: New → Confirmed
Revision history for this message
Daniel Hahler (blueyed) wrote :

Here is the changeset for the fix: http://svn.linuxrulz.org/WebSVN/listing.php?repname=Policyd&path=%2Ftrunk%2F&rev=4&sc=1

Revision history for this message
Daniel Hahler (blueyed) wrote :

Here is a debdiff for Feisty, but it does not include a fix for bug 91607 (upgrade failure), so please do not upload yet - just for reference.

Revision history for this message
Daniel Hahler (blueyed) wrote :

Moved LP reference from "References" to main line in debian/changelog.

Revision history for this message
Daniel Hahler (blueyed) wrote :
Revision history for this message
Daniel Hahler (blueyed) wrote :

Please upload the debdiff/new package.

It seems to be better IMHO to have a problem during upgrade (which has been there before already), but the security issue fixed.

I will also provide a debdiff for Dapper.

Revision history for this message
Daniel Hahler (blueyed) wrote :

I'm no C expert at all, but it appears to me that 1.55-1ubuntu1 is not affected:
 - w_read in policyd.c uses MAXLINE for length already
 - the sanity check in sockets.c does not seem to apply for sockets.c in 1.55 (http://svn.linuxrulz.org/WebSVN/diff.php?repname=Policyd&path=%2Ftrunk%2Fsockets.c&rev=4&sc=1)

Please double-check my investigations!

Changed in postfix-policyd:
status: New → Incomplete
Revision history for this message
Daniel Hahler (blueyed) wrote :

The same observations as for Dapper seem to apply to postfix-policyd (1.78-1) from Edgy.

Changed in postfix-policyd:
status: New → Incomplete
Revision history for this message
Kees Cook (kees) wrote :

Thanks! I've built this and it is pending upload now.

Changed in postfix-policyd:
assignee: nobody → keescook
status: Confirmed → Fix Committed
Revision history for this message
Daniel Hahler (blueyed) wrote :

postfix-policyd (1.80-2.1ubuntu0.1) feisty-security; urgency=low

  * SECURITY UPDATE: Fixed buffer overflow in w_read function (LP: #136687)
  * Applied patch from upstream SVN inline (no patch system used yet)
  * Fixed start/stop upgrade problems (LP: #91607).
  * References
    CVE-2007-3791

 -- dAniel hAhler <email address hidden> Sun, 02 Sep 2007 06:05:01 +0200

Changed in postfix-policyd:
status: Fix Committed → Fix Released
Daniel Hahler (blueyed)
Changed in postfix-policyd:
assignee: nobody → blueyed
status: Incomplete → Invalid
status: Incomplete → Invalid
assignee: nobody → blueyed
assignee: nobody → blueyed
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.