-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1



CERT* Advisory CA-98.08

Original issue date: July 14, 1998

Revised: August 24, 1998

         Added vendor information for Silicon Graphics Inc.



         A complete revision history is at the end of this file.



Topic: Buffer overflows in some POP servers



- -----------------------------------------------------------------------------



The CERT Coordination Center has received reports of buffer overflows

in some Post Office Protocol (POP) servers. For a list of vulnerable

versions and platforms, please refer to Appendix A. For help in

determining which version you are currently running, see Section III.A

below.



The CERT/CC team recommends that anyone running a vulnerable version of this

software upgrade to the current vendor-recommended version. Until you can do

so, we suggest disabling the POP server.



We will update this advisory as we receive additional information. Please

check our advisory files regularly for updates that relate to your site.



- -----------------------------------------------------------------------------



I.  Description



The CERT Coordination Center has received reports of buffer overflow

vulnerabilities in some POP servers based on QUALCOMM's

qpopper. Qpopper is a Post Office Protocol (POP) server used for

downloading Internet e-mail.



Information about this vulnerability has been posted to various

mailing lists and newsgroups, and the CERT Coordination Center has

received reports of incidents in which this vulnerability has been

exploited to gain privileged access.





II. Impact



Remote users can gain privileged (root) access to systems running

vulnerable versions of POP servers.





III. Solution



     If you determine that your POP server is vulnerable (Sec. A),

     install a patch from your vendor. Until you can do so, we urge you to

     disable the POP server.



     A. Determine if your version of the POP server is vulnerable.



         To determine if a system is vulnerable, first telnet to port 110 on

         that host. If it is running a POP server, the banner will show the

         version. For example:



               % telnet yourmailhost.your.domain.com 110

               Trying 123.123.123.123

               Connected to mailhost

               +OK QPOP (version 2.4) at yourmailhost.your.domain.com starting



         In the above example, the POP server is QUALCOMM's QPopper,

         version 2.4, which is known to be a vulnerable version.



         Check Appendix A to see if your vendor has identified other POP

         server versions that are vulnerable. If you do not see your vendor's

         name, please contact the vendor directly.



     B. Install a patch for this problem.



         Appendix A contains input from vendors who have provided information

         for this advisory.



     C. Workaround



         If you are unable to upgrade to a version that is not vulnerable,

         we urge you to disable the POP server until you are able to address

         the problem. (This will, of course, mean that the functionality

         provided by the POP server will not be available.)







~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~



Appendix A - Vendor Information



Below is a list of the vendors who have provided information for this

advisory. We will update this appendix as we receive additional information.

If you do not see your vendor's name, the CERT/CC did not hear from that

vendor. Please contact the vendor directly.







Data General

- ------------

Data General does not ship qpopper, or any other POP client or server.





Digital Equipment Corporation

- -----------------------------

Copyright 1994, 1995, 1996, 1997 Compaq Computer Corporation.  All rights

reserved.



SOURCE: Compaq Computer Corporation

        Compaq's Digital UNIX / ULTRIX

        Software Security Response Team USA





    This reported problem is not present for the as shipped,

    Compaq's Digital ULTRIX or Compaq's Digital UNIX

    Operating Systems Software.





Fujitsu

- -------

Fujitsu's UXP/V operating system does not support qpopper so we are not

affected by it.





OpenBSD

- -------

OpenBSD does not ship qpopper.





QUALCOMM Incorporated

- ---------------------

Versions of QUALCOMM qpopper prior to 2.5 are vulnerable.

QUALCOMM recommends upgrading to the most recent version

(currently Version 2.52). Patches are available from



         http://ftp.qualcomm.com/Eudora/servers/unix/popper



Further details, questions and comments should be sent to

.





Santa Cruz Operation, Inc.

- --------------------------

The following releases of SCO Operating Systems contain a version

of the Qualcomm popper that is vulnerable:



- - SCO OpenServer Releases 5.0.0, 5.0.2, 5.0.4

- - SCO Internet FastStart Releases 1.0, 1.1



The following SCO Operating Systems are not vulnerable,



- - SCO UnixWare 7

- - SCO UnixWare 2.1

- - SCO CMW+

- - SCO Open Desktop / Open Server 3.0, SCO UNIX 3.2v4



Binary versions of the patched popper will be available shortly

from the SCO ftp site:



http://ftp.sco.com/SSE/sse013.ltr - cover letter

http://ftp.sco.com/SSE/sse013.tar.Z - replacement binary



The fix includes binaries for the following SCO operating systems:



- - SCO OpenServer 5.0.0, 5.0.2, 5.0.4

- - SCO Internet FastStart Releases 1.0, 1.1



For the latest security bulletins and patches for SCO products,

please refer to http://www.sco.com/security/ .





Silicon Graphics Inc.

- ---------------------



Please refer to Silicon Graphics Inc. Security Advisory,

"BSD/Qualcomm qpopper Vulnerability," Number: 19980801-01-I,

distributed August 6, 1998 for additional information relating

to this vulnerability.



The primary SGI anonymous FTP site for security information and patches

is sgigate.sgi.com (204.94.209.1).  Security information and patches

are located under the directories ~ftp/security and ~ftp/patches,

respectively. The Silicon Graphics Security Headquarters Web page is

accessible at the URL http://www.sgi.com/Support/security/security.html.





- -----------------------------------------------------------------------------



The CERT Coordination Center thanks Travis Mikalson at TerraNovaNet,

Inc., for reporting the vulnerability, and Laurence Lundblade at

QUALCOMM Incorporated for providing technical details and support in the

development of the advisory. We also acknowledge other members of the

Internet community who posted about this problem.



- -----------------------------------------------------------------------------



If you believe that your system has been compromised, contact the CERT

Coordination Center or your representative in the Forum of Incident Response

and Security Teams (see http://www.first.org/team-info/).





CERT/CC Contact Information

- ----------------------------

Email    cert@cert.org



Phone    +1 412-268-7090 (24-hour hotline)

                CERT personnel answer 8:30-5:00 p.m. EST(GMT-5) / EDT(GMT-4)

                and are on call for emergencies during other hours.



Fax      +1 412-268-6989



Postal address

         CERT Coordination Center

         Software Engineering Institute

         Carnegie Mellon University

         Pittsburgh PA 15213-3890

         USA



Using encryption

   We strongly urge you to encrypt sensitive information sent by email. We can

   support a shared DES key or PGP. Contact the CERT/CC for more information.

   Location of CERT PGP key

         http://ftp.cert.org/pub/CERT_PGP.key



Getting security information

   CERT publications and other security information are available from

        http://www.cert.org/

        http://ftp.cert.org/pub/



   CERT advisories and bulletins are also posted on the USENET newsgroup

        comp.security.announce



   To be added to our mailing list for advisories and bulletins, send

   email to

        cert-advisory-request@cert.org

   In the subject line, type

        SUBSCRIBE  your-email-address



- ---------------------------------------------------------------------------



Copyright 1998 Carnegie Mellon University. Conditions for use, disclaimers,

and sponsorship information can be found in

http://www.cert.org/legal_stuff/legal_stuff.html and

http://ftp.cert.org/pub/legal_stuff .

If you do not have FTP or web access, send mail to cert@cert.org with

"copyright" in the subject line.



*CERT is registered in the U.S. Patent and Trademark Office.



- ---------------------------------------------------------------------------



This file: http://ftp.cert.org/pub/cert_advisories/CA-98.08.qpopper_vul

           http://www.cert.org/nav/alerts.html







~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Revision history



Aug. 24, 1998  Added vendor information for Silicon Graphics Inc.

July 22, 1998  Updated vendor information for Fujitsu and

               Santa Cruz Operation, Inc.

July 14, 1998  Added vendor information for Digital Equipment Corporation.



-----BEGIN PGP SIGNATURE-----

Version: PGP for Personal Privacy 5.0

Charset: noconv



iQA/AwUBOBTBt1r9kb5qlZHQEQIHLgCeNStJOnc65xO4KijmolUqeZe/EbwAn1YO

+AiRt3rZdXa/b4QZVZ2cmKR2

=JANF

-----END PGP SIGNATURE-----