$website = "http://developer.berlios.de/projects/$project";
$mailfrom = "<$project-devel-owner\@lists.berlios.de> (Fetchmail Development Team)";
+die "Need GNU sort!" unless `sort --version | head -n1` =~ /GNU/;
+
# parse options
$diffs = 0;
$verbose = 0;
$tag =~ tr/./-/;
# extract existing tags
-open(ID, "-|", "svn", "ls", $svnrepos . "/tags") || die "cannot run svn ls: $!\naborting";
+open(ID, "svn ls \"$svnrepos/tags\" | sort -t- -k1,1 -k2,2n -k3,3n |") || die "cannot run svn ls: $!\naborting";
while (<ID>) {
if (m{^(RELEASE_.*)/}) {
unshift(@versions, $1);
}
print "### Test-building the software...\n";
-if (system("mkdir -p autobuild && cd autobuild && ../configure -C --silent && make -s clean && make distcheck")) {
+if (system("mkdir -p autobuild && cd autobuild && ../configure -C --silent && make -s clean && make check distcheck")) {
die("Compilation failure\n");
}
-print "### Building the RPMs...\n";
-if (system("cd autobuild && cp ../fetchmail.xpm . && buildrpms $project-${version}.tar.bz2 $null")) {
- die("RPM-build failure\n");
-}
+# print "### Building the RPMs...\n";
+# if (system("cd autobuild && cp ../fetchmail.xpm . && buildrpms $project-${version}.tar.bz2 $null")) {
+# die("RPM-build failure\n");
+# }
open(REPORT, ">$tmp/$project.PREAMBLE.$$");
." -n -D 'diff between $oldver and $version' -m 'text/plain' -e 7bit -f $tmp/$project.DIFFS.$$"
." -o ANNOUNCE.EMAIL";
} else {
- system(mv, "$tmp/$project.PREAMBLE.$$", "ANNOUNCE.EMAIL");
+ system("mv", "$tmp/$project.PREAMBLE.$$", "ANNOUNCE.EMAIL");
}
#unlink("$tmp/$project.PREAMBLE.$$");
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA1
+
fetchmail-SA-2010-01: Heap overrun in verbose SSL cert' info display.
Topics: Heap overrun in verbose SSL certificate information display.
Type: malloc() Buffer overrun with printable characters
Impact: Code injection (difficult).
Danger: low
-CVSSv2 vectors:
-CVE Name:
+CVE Name: to be assigned via oss-security@ list
URL: http://www.fetchmail.info/fetchmail-SA-2010-01.txt
Project URL: http://www.fetchmail.info/
Not affected: fetchmail release 6.3.14 and newer
Corrected: 2010-02-04 fetchmail SVN (r5467)
+ 2010-02-05 fetchmail release 6.3.14
0. Release history
==================
-2010-02-04 0.1 first draft (visible in SVN)
+2010-02-04 0.1 first draft (visible in SVN and through oss-security)
+2010-02-05 1.0 fixed signed/unsigned typo (found by Nico Golde)
1. Background
\xFF..FFnn, where nn is 80..FF in hex.
This might be exploitable to inject code if
-- fetchmail is run in verbose mode
+- - fetchmail is run in verbose mode
AND
-- the host running fetchmail considers char signed
+- - the host running fetchmail considers char signed
AND
-- the server uses malicious certificates with non-printing characters
+- - the server uses malicious certificates with non-printing characters
that have the high bit set
AND
-- these certificates manage to inject shell-code that consists purely of
+- - these certificates manage to inject shell-code that consists purely of
printable characters.
It is believed to be difficult to achieve all this.
Whitespace differences can usually be ignored by invoking "patch -l",
so try this if the patch does not apply.
---- a/sdump.c
+- --- a/sdump.c
+++ b/sdump.c
@@ -36,7 +36,7 @@ char *sdump(const char *in, size_t len)
if (isprint((unsigned char)in[i])) {
*(oi++) = in[i];
} else {
-- oi += sprintf(oi, "\\x%02X", in[i]);
+- - oi += sprintf(oi, "\\x%02X", in[i]);
+ oi += sprintf(oi, "\\x%02X", (unsigned char)in[i]);
}
}
*oi = '\0';
END OF fetchmail-SA-2010-01.txt
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v2.0.12 (GNU/Linux)
+
+iEYEARECAAYFAktrbs0ACgkQvmGDOQUufZWzMQCg49F/WJiOjGwWZKHHzBcfTgx/
+sLIAmQHPO3mezy3Ku0O29b4AXHL2ZQNb
+=kF7s
+-----END PGP SIGNATURE-----