Format string vulnerability in the inc_put_error function in src/inc.c in Sylpheed 2.4.4, and Sylpheed-Claws (Claws Mail) 1.9.100 and 2.10.0, allows remote POP3 servers to execute arbitrary code via format string specifiers in crafted replies.

- Mon Sep 3 2007 Andreas Bierfert     <andreas.bierfert[AT]lowlatency.de>

    - 3.0.0-1

    - version upgrade

    - new license tag (upstream switch to GPLv3+)

    - fix #254121 (CVE-2007-2958)

    - Wed Aug 22 2007 Andreas Bierfert       <andreas.bierfert[AT]lowlatency.de>

    - 2.10.0-4

    - new license tag

    - Wed Jul 18 2007 Andreas Bierfert       <andreas.bierfert[AT]lowlatency.de>

    - 2.10.0-3

    - build against libSM (#248675)

    - Mon Jul 16 2007 Andreas Bierfert       <andreas.bierfert[AT]lowlatency.de>

    - 2.10.0-2

    - add requires for bogofilter (#246125)

    - Tue Jul 3 2007 Andreas Bierfert       <andreas.bierfert[AT]lowlatency.de>

    - 2.10.0-1

    - version upgrade

    - fix #246230

    - Tue May 15 2007 Andreas Bierfert       <andreas.bierfert[AT]lowlatency.de> 2.9.2-1

  - version upgrade

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Ulf Harnhammar (Secunia Research) has discovered a format string vulnerability in sylpheed and claws-mail in inc_put_error() function in src/inc.c when displaying POP3 error reply.

Problem can be exploited by malicious POP3 server via specially crafted POP3 server replies containing format specifiers.

Successful exploitation may allow execution of arbitrary code, but requires that the user is tricked into connecting to a malicious POP3 server.

Secunia advisory: http://secunia.com/advisories/26550/

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200710-29 (Sylpheed, Claws Mail: User-assisted remote execution of arbitrary code)

    Ulf Harnhammar from Secunia Research discovered a format string error     in the inc_put_error() function in file src/inc.c.
  Impact :

    A remote attacker could entice a user to connect to a malicious POP     server sending specially crafted replies, possibly resulting in the     execution of arbitrary code with the privileges of the user running the     application.
  Workaround :

    There is no known workaround at this time.

This update fixes a format string bug in the inc_put_error() function.
This bug is triggered when error messages from the POP3 server are displayed and can be exploited remotely to execute arbitrary code.
(CVE-2007-2958)

A Secunia Advisory reports :

A format string error in the 'inc_put_error()' function in src/inc.c when displaying a POP3 server's error response can be exploited via specially crafted POP3 server replies containing format specifiers.

Successful exploitation may allow execution of arbitrary code, but requires that the user is tricked into connecting to a malicious POP3 server.

ID	Name	Product	Family	Severity
27743	Fedora 7 : claws-mail-3.0.0-1.fc7 (2007-2009)	Nessus	Fedora Local Security Checks	medium
27736	Fedora 7 : sylpheed-2.3.1-5 (2007-1841)	Nessus	Fedora Local Security Checks	medium
27580	GLSA-200710-29 : Sylpheed, Claws Mail: User-assisted remote execution of arbitrary code	Nessus	Gentoo Local Security Checks	medium
27461	openSUSE 10 Security Update : sylpheed-claws (sylpheed-claws-4511)	Nessus	SuSE Local Security Checks	medium
27186	openSUSE 10 Security Update : claws-mail (claws-mail-4495)	Nessus	SuSE Local Security Checks	medium
25943	FreeBSD : claws-mail -- POP3 Format String Vulnerability (d9867f50-54d0-11dc-b80b-0016179b2dd5)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2007-2958

critical

Tenable Plugins

medium

medium

medium

medium

medium

medium