----- Original Message -----
From: "Gabriel Ambuehl" <[EMAIL PROTECTED]>
> > buffer overflow will effectively replace the address for the MAIL FROM
> > command of outgoing smtp session with crap leading in email rejections
> > remote smtp servers.
> Hmm that's bad...

Well, it's been around forever. I first noticed the bug in FreeBSD
3.4-STABLE. I have sent the patch to the FreeBSD team and code to test if a
particular installation is vulnerable.

The issue is as much with qmail as with the FreeBSD code. Most application
that try to discover the interfaces present on a given system use the same
system call as qmail, but with a large buffer (usually around 8k). This
buffer is big enough in 99.99% of the case. Qmail on the other hand tries to
save a few bytes here and there, so it uses the system call with a very
small buffer (256 bytes) and then increases it by a few bytes until it knows
that it got all the interfaces.

The only advantage of qmail's way is that is save some memory. The main
drawbacks are:
- it is vulnerable to the BSD socket bug (which is not limited to FreeBSD)
- it uses a fairly high number of system calls to do something that should
be done
  in one system call.

Qmail can be patched for that problem as well.

(here it is)

--- ipme.c.orig      2000/04/08 18:49:08
+++ ipme.c      2000/04/09 08:14:11
@@ -48,7 +48,7 @@

   if ((s = socket(AF_INET,SOCK_STREAM,0)) == -1) return -1;

-  len = 256;
+  len = 8092; /* any value big enough to get all the interfaces in one read
is good */
   for (;;) {
     if (!stralloc_ready(&buf,len)) { close(s); return 0; }
     buf.len = 0;
@@ -60,7 +60,7 @@
     if (len > 200000) { close(s); return -1; }
-    len += 100 + (len >> 2);
+    len *= 2;
   x = buf.s;
   while (x < buf.s + buf.len) {

> > The file to patch is /usr/src/sys/net/if.c, the attached patch is
> > the current RELENG_4 version.
> Do you mean 4.0 Current or 4.0 Release (we'll use the later, if WC
> sends us the CDs.. Ordered them since they're scheduled but nothing
> yet arrived)?

This is for any FreeBSD to date. And as for the CD's we got ours last week,
so yours should not be too far away...


Reply via email to