DSA-083-1 procmail -- insecure signal handling

Debian Security Advisory

DSA-083-1 procmail -- insecure signal handling

Date Reported:

18 Oct 2001

Affected Packages:

procmail

Vulnerable:

Yes

Security database references:

In Mitre's CVE dictionary: CVE-2001-0905.

More information:

Using older versions of procmail it was possible to make procmail crash by sending it signals. On systems where procmail is installed setuid this could be exploited to obtain unauthorized privileges.

This problem has been fixed in version 3.20 by the upstream maintainer, included in Debian unstable, and was ported back to version 3.15.2 which is available for the stable Debian GNU/Linux 2.2.

We recommend that you upgrade your procmail package immediately.

Fixed in:

Debian GNU/Linux 2.2 (potato)

Source:

http://security.debian.org/dists/stable/updates/main/source/procmail_3.15.2-1.diff.gz

http://security.debian.org/dists/stable/updates/main/source/procmail_3.15.2-1.dsc

http://security.debian.org/dists/stable/updates/main/source/procmail_3.15.2.orig.tar.gz

Alpha:

http://security.debian.org/dists/stable/updates/main/binary-alpha/procmail_3.15.2-1_alpha.deb

ARM:

http://security.debian.org/dists/stable/updates/main/binary-arm/procmail_3.15.2-1_arm.deb

Intel ia32:

http://security.debian.org/dists/stable/updates/main/binary-i386/procmail_3.15.2-1_i386.deb

Motorola 680x0:

http://security.debian.org/dists/stable/updates/main/binary-m68k/procmail_3.15.2-1_m68k.deb

PowerPC:

http://security.debian.org/dists/stable/updates/main/binary-powerpc/procmail_3.15.2-1_powerpc.deb

Sun Sparc:

http://security.debian.org/dists/stable/updates/main/binary-sparc/procmail_3.15.2-1_sparc.deb

MD5 checksums of the listed files are available in the original advisory.