Bug 223777 - mail/procmail: CVE-2017-16844 heap overflow affecting formail
Summary: mail/procmail: CVE-2017-16844 heap overflow affecting formail
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Many People
Assignee: Po-Chuan Hsieh
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-11-21 04:22 UTC by Jeremy Chadwick
Modified: 2017-12-12 11:45 UTC (History)
1 user (show)

See Also:
bugzilla: maintainer-feedback? (sunpoet)

Attachments
formisc.c patch (for procmail 3.22) from Debian (530 bytes, patch)
2017-11-21 04:23 UTC, Jeremy Chadwick 		no flags Details | Diff
Patch against the mail/procmail port (969 bytes, patch)
2017-11-22 08:26 UTC, Romain Tartière 		no flags Details | Diff
Patch against the security/vuxml port (335 bytes, patch)
2017-11-22 08:27 UTC, Romain Tartière 		no flags Details | Diff
Show Obsolete (1) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Jeremy Chadwick 2017-11-21 04:22:34 UTC 
procmail's formail utility contains a heap overflow which can cause a denial-of-service if given certain malformed mail.

Details:

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16844
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=876511
https://www.debian.org/security/2017/dsa-4041
https://usn.ubuntu.com/usn/usn-3483-1/

Patch for 3.22, which I'll also attach, but be aware FreeBSD uses procmail 3.21 and I'm unsure if the patch is compatible:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=876511#10

If upgrading to procmail 3.22 is thus required, this is the location for the code (the official procmail website has been down for almost 4 months now): http://www.ring.gr.jp/archives/net/mail/procmail/procmail-3.22.tar.gz
Comment 1 Jeremy Chadwick 2017-11-21 04:23:44 UTC 
Created attachment 188149 [details]
formisc.c patch (for procmail 3.22) from Debian

Patch source: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=876511#10
Comment 2 Romain Tartière freebsd_committer freebsd_triage 2017-11-22 08:26:25 UTC 
Created attachment 188191 [details]
Patch against the mail/procmail port

Integrate Debian's patch in the FreeBSD port.
Comment 3 Romain Tartière freebsd_committer freebsd_triage 2017-11-22 08:27:32 UTC 
Created attachment 188192 [details]
Patch against the security/vuxml port

The vuxml file should also be updated.  I guess that procmail-3.23 is quite unlikely to happen…
Comment 4 Romain Tartière freebsd_committer freebsd_triage 2017-11-22 08:29:34 UTC 
Comment on attachment 188149 [details]
formisc.c patch (for procmail 3.22) from Debian

Mark Debian's patch as obsolete now that a patch against the FreeBSD tree is attached to this bug.  While here, complete it's description
Comment 5 commit-hook freebsd_committer freebsd_triage 2017-12-08 20:35:45 UTC 
A commit references this bug:

Author: sunpoet
Date: Fri Dec  8 20:35:26 UTC 2017
New revision: 455799
URL: https://svnweb.freebsd.org/changeset/ports/455799

Log:
  Fix version range of mail/procmail

  PR:		223777
  Submitted by:	romain

Changes:
  head/security/vuxml/vuln.xml
Comment 6 commit-hook freebsd_committer freebsd_triage 2017-12-08 20:35:47 UTC 
A commit references this bug:

Author: sunpoet
Date: Fri Dec  8 20:35:32 UTC 2017
New revision: 455800
URL: https://svnweb.freebsd.org/changeset/ports/455800

Log:
  Fix CVE-2017-16844

  - Bump PORTREVISION for package change

  PR:		223777
  Submitted by:	Jeremy Chadwick <jdc@koitsu.org>, romain
  Security:	288f7cee-ced6-11e7-8ae9-0050569f0b83
  MFH:		2017Q4

Changes:
  head/mail/procmail/Makefile
  head/mail/procmail/files/patch-src-formisc.c
Comment 7 Po-Chuan Hsieh freebsd_committer freebsd_triage 2017-12-08 20:36:50 UTC 
Committed. Thanks!
Comment 8 commit-hook freebsd_committer freebsd_triage 2017-12-12 11:45:33 UTC 
A commit references this bug:

Author: sunpoet
Date: Tue Dec 12 11:45:13 UTC 2017
New revision: 456121
URL: https://svnweb.freebsd.org/changeset/ports/456121

Log:
  MFH: r455800

  Fix CVE-2017-16844

  - Bump PORTREVISION for package change

  PR:		223777
  Submitted by:	Jeremy Chadwick <jdc@koitsu.org>, romain
  Security:	288f7cee-ced6-11e7-8ae9-0050569f0b83

  Approved by:	ports-secteam (swills)

Changes:
_U  branches/2017Q4/
  branches/2017Q4/mail/procmail/Makefile
  branches/2017Q4/mail/procmail/files/patch-src-formisc.c