Your message dated Sat, 19 Feb 2005 15:32:11 -0500
with message-id <[EMAIL PROTECTED]>
and subject line Bug#295411: fixed in sympa 4.1.5-1
has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere. Please contact me immediately.)
Debian bug tracking system administrator
(administrator, Debian Bugs database)
--------------------------------------
Received: (at submit) by bugs.debian.org; 15 Feb 2005 17:31:13 +0000
>From [EMAIL PROTECTED] Tue Feb 15 09:31:13 2005
Return-path: <[EMAIL PROTECTED]>
Received: from oban.u-picardie.fr (mailx.u-picardie.fr) [193.49.184.8]
by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
id 1D16XY-0004VU-00; Tue, 15 Feb 2005 09:31:13 -0800
Received: from localhost (localhost [127.0.0.1])
by mailx.u-picardie.fr (Postfix) with ESMTP id 1C95F988DA;
Tue, 15 Feb 2005 18:31:11 +0100 (CET)
Received: from mailx.u-picardie.fr ([127.0.0.1])
by localhost (oban [127.0.0.1]) (amavisd-new, port 10024) with LMTP
id 30201-01; Tue, 15 Feb 2005 18:31:06 +0100 (CET)
Received: by mailx.u-picardie.fr (Postfix, from userid 1000)
id 621F3984DB; Tue, 15 Feb 2005 18:31:06 +0100 (CET)
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
From: Jean Charles Delepine <[EMAIL PROTECTED]>
To: Debian Bug Tracking System <[EMAIL PROTECTED]>
Subject: sympa: CERTA-2005-AVI-078 : bouncequeue and queue can execute
arbitrary code
because of a buffer overflow
X-Mailer: reportbug 3.2
Date: Tue, 15 Feb 2005 18:31:06 +0100
Message-Id: <[EMAIL PROTECTED]>
X-Virus-Scanned: by amavisd-new-20030616-p10 (Debian) at UPJV
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-8.0 required=4.0 tests=BAYES_00,HAS_PACKAGE
autolearn=no version=2.60-bugs.debian.org_2005_01_02
X-Spam-Level:
Package: sympa
Version: 4.1.2-2.1
Severity: grave
Justification: user security hole
----- Forwarded message from Aumont - Comite Reseaux des Universites <[EMAIL
PROTECTED]> -----
Return-Path: [EMAIL PROTECTED]
Date: Tue, 15 Feb 2005 18:09:54 +0100
From: Aumont - Comite Reseaux des Universites <[EMAIL PROTECTED]>
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.3) Gecko/20040922
To: [EMAIL PROTECTED]
Subject: [sympa-announce] Security advisory
Reply-To: [EMAIL PROTECTED]
French CERT as published a security advisory (reference
CERTA-2005-AVI-078) : bouncequeue and queue can execute arbitrary code
because of a buffer overflow.
This concern all version of Sympa (including 5.0b) except 4.1.3, 4.1.4
and 4.1.5.
Please refer to http://www.sympa.org for solutions.
Serge Aumont
----------
The patches are :
http://sourcesup.cru.fr/cgi/viewcvs.cgi/sympa/src/queue.c.diff?r2=1.4.2.1&cvsroot=sympa&r1=1.4&diff_format=u
http://sourcesup.cru.fr/cgi/viewcvs.cgi/sympa/src/bouncequeue.c.diff?r2=1.4.2.1&cvsroot=sympa&r1=1.4&diff_format=u
-- System Information:
Debian Release: 3.1
APT prefers testing
APT policy: (900, 'testing'), (10, 'unstable')
Architecture: i386 (i686)
Kernel: Linux 2.6.9-2-686-smp
Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968)
Versions of packages sympa depends on:
ii adduser 3.59 Add and remove users and groups
ii debconf 1.4.30.8 Debian configuration management sy
ii libc6 2.3.2.ds1-18 GNU C Library: Shared libraries an
ii libcgi-fast-perl 5.8.4-3 CGI::Fast Perl module
ii libcrypt-ciphersaber-perl 0.61-4 Perl module implementing CipherSab
ii libdbd-mysql-perl 2.9003-3 A Perl5 database interface to the
ii libdbi-perl 1.45-1 The Perl5 Database Interface by Ti
ii libfcgi-perl 0.67-1 FastCGI Perl module
ii libio-stringy-perl 2.109-2 Perl5 modules for IO from scalars
ii libmailtools-perl 1.62-1 Manipulate email in perl programs
ii libmd5-perl 2.03-1 backwards-compatible wrapper for D
ii libmime-perl 5.415-1 Perl5 modules for MIME-compliant m
ii libmsgcat-perl 1.03-3 Locale::Msgcat perl module
ii libnet-ldap-perl 0.3202-2 A Client interface to LDAP servers
ii mhonarc 2.6.10-1 Mail to HTML converter
ii perl [libmime-base64-perl] 5.8.4-6 Larry Wall's Practical Extraction
ii perl-suid 5.8.4-6 Runs setuid Perl scripts
ii postfix [mail-transport-age 2.1.4-5 A high-performance mail transport
ii sysklogd [system-log-daemon 1.4.1-15 System Logging Daemon
-- debconf information excluded
---------------------------------------
Received: (at 295411-close) by bugs.debian.org; 19 Feb 2005 20:38:07 +0000
>From [EMAIL PROTECTED] Sat Feb 19 12:38:07 2005
Return-path: <[EMAIL PROTECTED]>
Received: from newraff.debian.org [208.185.25.31] (mail)
by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
id 1D2bMc-0002S4-00; Sat, 19 Feb 2005 12:38:06 -0800
Received: from katie by newraff.debian.org with local (Exim 3.35 1 (Debian))
id 1D2bGt-00055v-00; Sat, 19 Feb 2005 15:32:11 -0500
From: Stefan Hornburg (Racke) <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
X-Katie: $Revision: 1.55 $
Subject: Bug#295411: fixed in sympa 4.1.5-1
Message-Id: <[EMAIL PROTECTED]>
Sender: Archive Administrator <[EMAIL PROTECTED]>
Date: Sat, 19 Feb 2005 15:32:11 -0500
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-6.0 required=4.0 tests=BAYES_00,HAS_BUG_NUMBER
autolearn=no version=2.60-bugs.debian.org_2005_01_02
X-Spam-Level:
X-CrossAssassin-Score: 4
Source: sympa
Source-Version: 4.1.5-1
We believe that the bug you reported is fixed in the latest version of
sympa, which is due to be installed in the Debian FTP archive:
sympa_4.1.5-1.diff.gz
to pool/main/s/sympa/sympa_4.1.5-1.diff.gz
sympa_4.1.5-1.dsc
to pool/main/s/sympa/sympa_4.1.5-1.dsc
sympa_4.1.5-1_i386.deb
to pool/main/s/sympa/sympa_4.1.5-1_i386.deb
sympa_4.1.5.orig.tar.gz
to pool/main/s/sympa/sympa_4.1.5.orig.tar.gz
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [EMAIL PROTECTED],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Stefan Hornburg (Racke) <[EMAIL PROTECTED]> (supplier of updated sympa package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [EMAIL PROTECTED])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.7
Date: Sat, 19 Feb 2005 17:32:57 +0100
Source: sympa
Binary: sympa
Architecture: source i386
Version: 4.1.5-1
Distribution: unstable
Urgency: high
Maintainer: Stefan Hornburg (Racke) <[EMAIL PROTECTED]>
Changed-By: Stefan Hornburg (Racke) <[EMAIL PROTECTED]>
Description:
sympa - Modern mailing list manager
Closes: 282103 291462 293661 295411 295981
Changes:
sympa (4.1.5-1) unstable; urgency=high
.
* new upstream release (Closes: #293661):
- fixes buffer overflow in bouncequeue and queue (Closes: #295411,
CERTA-2005-AVI-078)
- adds missing function do_arc_delete to wwsympa.fcgi
(Closes: #282103, thanks to Gregory Colpart <[EMAIL PROTECTED]> for the
report)
* create /etc/mail/sympa.aliases if necessary
* updated dependencies for Perl modules (Closes: #291462, thanks to Marc
Sherman <[EMAIL PROTECTED]> for the report)
* added Czech debconf template translation (Closes: #295981, thanks to
Miroslav Kure <[EMAIL PROTECTED]>)
Files:
72f6b24c91a688617054386066f71202 602 mail optional sympa_4.1.5-1.dsc
60150733a3c27189704465aabf708b8d 2130880 mail optional sympa_4.1.5.orig.tar.gz
cd2791ceb6c232af26b3d7cd9d795601 79823 mail optional sympa_4.1.5-1.diff.gz
a5e33f8c93cb196fc482ece70ca4fdf9 1173662 mail optional sympa_4.1.5-1_i386.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (GNU/Linux)
iD8DBQFCF5ukjgVfE5tya3ERAsBPAJ4vuvMZgZv5hBxBdHsxGZMCJvZmRwCfctjJ
18jpQa8EXX9NeA9gHQjc5x0=
=gT9R
-----END PGP SIGNATURE-----
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
