Bug 107519 - CAN-2003-0855 Pan crash on long email address
CAN-2003-0855 Pan crash on long email address
Product: Red Hat Linux
Classification: Retired
Component: pan (Show other bugs)
All Linux
low Severity medium
: ---
: ---
Assigned To: Jens Petersen
David Lawrence
: Security
Depends On:
  Show dependency treegraph
Reported: 2003-10-19 18:38 EDT by Kasper Dupont
Modified: 2007-03-27 00:10 EDT (History)
0 users

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2003-11-24 03:49:19 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Kasper Dupont 2003-10-19 18:38:29 EDT
Description of problem:
If you try to view a group with a posting with a long sender address pan core dumps.

Version-Release number of selected component (if applicable):

How reproducible:
Happens every time.

Steps to Reproduce:
1. Post a message with a long address in From:
2. Try to view the group with pan
Actual results:
Pan dumps core

Expected results:
Pan views the group correctly possibly truncating the email address to a
reasonable length.

Additional info:
The bug is listed as security because it is possibly a buffer overflow that
could potentially be used to execute arbitrary code in every pan client viewing
the group.

The problem was first seen with a 702 character long email address in the
<mlknecndwmlmnhrntstjauevkcntugtxzvxdvqueiivkcqurmwavvxs@skrammel.yaboo.dk> in
the group dk.test on the server news.tele.dk.
Comment 1 Kasper Dupont 2003-10-22 09:32:17 EDT
Pan also dumps core while getting the list of newsgroups if the server does not
send a ^M char at the end of each line.
Comment 2 Mark J. Cox (Product Security) 2003-10-24 11:48:35 EDT
Okay, this is a known issue with patch available:

We'll look at doing a security update to PAN.
Comment 3 Mark J. Cox (Product Security) 2003-10-28 09:21:07 EST
To follow up on this, the crash causes a null byte to be written to 0x00 which
causes a crash but isn't able to be exploited further (therefore this is limited
to a DoS).  Errata in progress.

RHSA-2003:311 in progress
Comment 4 Jens Petersen 2003-10-28 22:30:23 EST
For the record, apparently this was fixed in 0.13.4.
Comment 6 Mark J. Cox (Product Security) 2003-11-24 03:49:19 EST
An errata has been issued which should help the problem described in this bug report. 
This report is therefore being closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files, please follow the link below. You may reopen 
this bug report if the solution does not work for you.


Note You need to log in before you can comment on or make changes to this bug.