Version alpha4.

[~andy/fetchmail] / fetchmail-SA-2007-02.txt

diff --git a/fetchmail-SA-2007-02.txt b/fetchmail-SA-2007-02.txt
index 74fc5558c8be92a5ff3b823d7c440ccc62b14b7e..c48ff70d818bacfe1dff7257dec56b4867ea5f90 100644 (file)
--- a/fetchmail-SA-2007-02.txt
+++ b/fetchmail-SA-2007-02.txt
@@ -1,3 +1,6 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA1
+

 fetchmail-SA-2007-02: Crash when a local warning message is rejected
 
 Topics:                Crash when a fetchmail-generated warning message is rejected
 fetchmail-SA-2007-02: Crash when a local warning message is rejected
 
 Topics:                Crash when a fetchmail-generated warning message is rejected


@@ -12,8 +15,8 @@ CVSS V2 vector: (AV:N/AC:M/Au:N/C:N/I:N/A:C/E:?/RL:O/RC:C)
                
 Credits:       Earl Chew
 CVE Name:      CVE-2007-4565
                
 Credits:       Earl Chew
 CVE Name:      CVE-2007-4565

-URL:           http://fetchmail.berlios.de/fetchmail-SA-2007-02.txt
-Project URL:   http://fetchmail.berlios.de/
+URL:           http://www.fetchmail.info/fetchmail-SA-2007-02.txt
+Project URL:   http://www.fetchmail.info/

 
 Affects:       fetchmail release < 6.3.9 exclusively
 
 
 Affects:       fetchmail release < 6.3.9 exclusively
 


@@ -60,9 +63,9 @@ This causes fetchmail to crash and not collect further messages until it
 is restarted.
 
 Risk assessment: low. In default configuration, fetchmail will talk 
 is restarted.
 
 Risk assessment: low. In default configuration, fetchmail will talk 

-through the loopback interface, that is to the SMTP listener on the same 
+through the loopback interface, that means to the SMTP server on the same 

 computer as it is running on. Otherwise, it will commonly be configured 
 computer as it is running on. Otherwise, it will commonly be configured 

-to talk to trusted SMTP servers, so a compromise of misconfiguration of 
+to talk to trusted SMTP servers, so a compromise or misconfiguration of 

 a trusted or the same computer is required to exploit this problem - 
 which usually opens up much easier ways of denying service, or worse.
 
 a trusted or the same computer is required to exploit this problem - 
 which usually opens up much easier ways of denying service, or worse.
 


@@ -89,32 +92,46 @@ A. Copyright, License and Warranty
 (C) Copyright 2007 by Matthias Andree, <matthias.andree@gmx.de>.
 Some rights reserved.
 
 (C) Copyright 2007 by Matthias Andree, <matthias.andree@gmx.de>.
 Some rights reserved.
 

-This work is licensed under the Creative Commons
-Attribution-NonCommercial-NoDerivs German License. To view a copy of
-this license, visit http://creativecommons.org/licenses/by-nc-nd/2.0/de/
-or send a letter to Creative Commons; 559 Nathan Abbott Way;
-Stanford, California 94305; USA.
+This work is licensed under the
+Creative Commons Attribution-NoDerivs 3.0 Germany License (CC BY-ND 3.0).
+
+To view a copy of this license, visit
+http://creativecommons.org/licenses/by-nd/3.0/de/deed.en
+or send a letter to:
+
+Creative Commons
+444 Castro Street
+Suite 900
+MOUNTAIN VIEW, CALIFORNIA 94041
+USA
+

 
 THIS WORK IS PROVIDED FREE OF CHARGE AND WITHOUT ANY WARRANTIES.
 Use the information herein at your own risk.
 
 
 
 THIS WORK IS PROVIDED FREE OF CHARGE AND WITHOUT ANY WARRANTIES.
 Use the information herein at your own risk.
 
 

-

 B. Patch to remedy the problem
 ==============================
 
 Index: sink.c
 ===================================================================
 B. Patch to remedy the problem
 ==============================
 
 Index: sink.c
 ===================================================================

---- sink.c     (revision 5118)
+- --- sink.c   (revision 5118)

 +++ sink.c     (revision 5119)
 @@ -262,7 +262,7 @@
      const char *md1 = "MAILER-DAEMON", *md2 = "MAILER-DAEMON@";
  
      /* don't bounce in reply to undeliverable bounces */
 +++ sink.c     (revision 5119)
 @@ -262,7 +262,7 @@
      const char *md1 = "MAILER-DAEMON", *md2 = "MAILER-DAEMON@";
  
      /* don't bounce in reply to undeliverable bounces */

--    if (!msg->return_path[0] ||
+- -    if (!msg->return_path[0] ||

 +    if (!msg || !msg->return_path[0] ||
        strcmp(msg->return_path, "<>") == 0 ||
        strcasecmp(msg->return_path, md1) == 0 ||
        strncasecmp(msg->return_path, md2, strlen(md2)) == 0)
 
 END OF fetchmail-SA-2007-02.txt
 +    if (!msg || !msg->return_path[0] ||
        strcmp(msg->return_path, "<>") == 0 ||
        strcasecmp(msg->return_path, md1) == 0 ||
        strncasecmp(msg->return_path, md2, strlen(md2)) == 0)
 
 END OF fetchmail-SA-2007-02.txt

+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v1.4.11 (GNU/Linux)
+
+iEYEARECAAYFAk9/Yg4ACgkQvmGDOQUufZWWKwCfX4Ri89SzzUcXYxughs1CdnAk
+Z6IAniD4DzayVUR6UxA5K1OqX1CUDOhM
+=+YME
+-----END PGP SIGNATURE-----