Hylafax Incoming TSI Format String Denial Of Service Vulnerability

Bugtraq ID:	5348
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 29 2002 12:00AM
Updated:	Jul 29 2002 12:00AM
Credit:	Discovery is credited to iFax Solutions.
Vulnerable:	Hylafax Hylafax 4.1.2 Hylafax Hylafax 4.1.1 + Debian Linux 3.0 Hylafax Hylafax 4.1 -beta3 Hylafax Hylafax 4.1 -beta2 + SuSE Linux 7.2 i386 + SuSE Linux 7.2 + SuSE Linux 7.1 x86 + SuSE Linux 7.1 sparc + SuSE Linux 7.1 ppc + SuSE Linux 7.1 alpha + SuSE Linux 7.1 + SuSE Linux 7.0 sparc + SuSE Linux 7.0 ppc + SuSE Linux 7.0 i386 + SuSE Linux 7.0 alpha + SuSE Linux 7.0 Hylafax Hylafax 4.1 -beta1 Hylafax Hylafax 4.1 - FreeBSD FreeBSD 4.4 + MandrakeSoft Corporate Server 1.0.1 + Mandriva Linux Mandrake 8.2 ppc + Mandriva Linux Mandrake 8.2 + Mandriva Linux Mandrake 8.1 ia64 + Mandriva Linux Mandrake 8.1 + Mandriva Linux Mandrake 8.0 ppc + Mandriva Linux Mandrake 8.0 + Mandriva Linux Mandrake 7.2 + Mandriva Linux Mandrake 7.1 + SuSE Linux 8.0 i386 + SuSE Linux 8.0 + SuSE Linux 7.3 sparc + SuSE Linux 7.3 ppc + SuSE Linux 7.3 i386 + SuSE Linux 7.3 Hylafax Hylafax 4.0.2 + Debian Linux 2.3 sparc + Debian Linux 2.3 powerpc + Debian Linux 2.3 arm + Debian Linux 2.3 alpha + Debian Linux 2.3 68k + Debian Linux 2.3 - FreeBSD FreeBSD 3.3 - FreeBSD FreeBSD 3.2 - FreeBSD FreeBSD 3.1 - FreeBSD FreeBSD 3.0 Hylafax Hylafax 4.0 pl2 Hylafax Hylafax 4.0 pl1 Hylafax Hylafax 4.0 pl0
Not Vulnerable:	Hylafax Hylafax 4.1.3 + Mandriva Linux Mandrake 8.2 ppc + Mandriva Linux Mandrake 8.2 + Mandriva Linux Mandrake 8.1 ia64 + Mandriva Linux Mandrake 8.1 + Mandriva Linux Mandrake 8.0 ppc + Mandriva Linux Mandrake 8.0 + SuSE Linux 8.1

Hylafax Incoming TSI Format String Denial Of Service Vulnerability

Hylafax is a software package designed to handle the transmission of faxes.

Incoming fax messages include a Transmitting Subscriber Identification (TSI) string, used to identify the fax machine of origin. Some versions of Hylafax use this data as part of a format string without properly sanitizing the input. Malicious fax data may cause the server to crash, resulting in a denial of service condition.

Hylafax Incoming TSI Format String Denial Of Service Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Hylafax Incoming TSI Format String Denial Of Service Vulnerability

Solution:
FreeBSD has released upgrades. Users are advised to upgrade their ports collection and reinstall the affected port.

Fixes are available:


Hylafax Hylafax 4.0.2

• Debian hylafax-client_4.0.2-14.3_alpha.deb
  http://security.debian.org/pool/updates/main/h/hylafax/hylafax-client_ 4.0.2-14.3_alpha.deb


• Debian hylafax-client_4.0.2-14.3_arm.deb
  http://security.debian.org/pool/updates/main/h/hylafax/hylafax-client_ 4.0.2-14.3_arm.deb


• Debian hylafax-client_4.0.2-14.3_i386.deb
  http://security.debian.org/pool/updates/main/h/hylafax/hylafax-client_ 4.0.2-14.3_i386.deb


• Debian hylafax-client_4.0.2-14.3_m68k.deb
  http://security.debian.org/pool/updates/main/h/hylafax/hylafax-client_ 4.0.2-14.3_m68k.deb


• Debian hylafax-client_4.0.2-14.3_powerpc.deb
  http://security.debian.org/pool/updates/main/h/hylafax/hylafax-client_ 4.0.2-14.3_powerpc.deb


• Debian hylafax-client_4.0.2-14.3_sparc.deb
  http://security.debian.org/pool/updates/main/h/hylafax/hylafax-client_ 4.0.2-14.3_sparc.deb


• Debian hylafax-doc_4.0.2-14.3_all.deb
  http://security.debian.org/pool/updates/main/h/hylafax/hylafax-doc_4.0 .2-14.3_all.deb


• Debian hylafax-server_4.0.2-14.3_alpha.deb
  http://security.debian.org/pool/updates/main/h/hylafax/hylafax-server_ 4.0.2-14.3_alpha.deb


• Debian hylafax-server_4.0.2-14.3_arm.deb
  http://security.debian.org/pool/updates/main/h/hylafax/hylafax-server_ 4.0.2-14.3_arm.deb


• Debian hylafax-server_4.0.2-14.3_i386.deb
  http://security.debian.org/pool/updates/main/h/hylafax/hylafax-server_ 4.0.2-14.3_i386.deb


• Debian hylafax-server_4.0.2-14.3_m68k.deb
  http://security.debian.org/pool/updates/main/h/hylafax/hylafax-server_ 4.0.2-14.3_m68k.deb


• Debian hylafax-server_4.0.2-14.3_powerpc.deb
  http://security.debian.org/pool/updates/main/h/hylafax/hylafax-server_ 4.0.2-14.3_powerpc.deb


• Debian hylafax-server_4.0.2-14.3_sparc.deb
  http://security.debian.org/pool/updates/main/h/hylafax/hylafax-server_ 4.0.2-14.3_sparc.deb


• Hylafax hylafax-4.1.3.tar.gz
  ftp://ftp.hylafax.org/source/hylafax-4.1.3.tar.gz

Hylafax Hylafax 4.1 -beta1

• Hylafax hylafax-4.1.3.tar.gz
  ftp://ftp.hylafax.org/source/hylafax-4.1.3.tar.gz

Hylafax Hylafax 4.1 -beta3

• Hylafax hylafax-4.1.3.tar.gz
  ftp://ftp.hylafax.org/source/hylafax-4.1.3.tar.gz

Hylafax Hylafax 4.1 -beta2

• Hylafax hylafax-4.1.3.tar.gz
  ftp://ftp.hylafax.org/source/hylafax-4.1.3.tar.gz


• S.u.S.E. hylafax-4.1beta2-217.ppc.rpm
  ftp://ftp.suse.com/pub/suse/ppc/update/7.0/n2/hylafax-4.1beta2-217.ppc .rpm


• S.u.S.E. hylafax-4.1beta2-218.ppc.rpm
  ftp://ftp.suse.com/pub/suse/ppc/update/7.1/n3/hylafax-4.1beta2-218.ppc .rpm


• S.u.S.E. hylafax-4.1beta2-218.sparc.rpm
  ftp://ftp.suse.com/pub/suse/sparc/update/7.0/n2/hylafax-4.1beta2-218.s parc.rpm


• S.u.S.E. hylafax-4.1beta2-218.sparc.rpm
  ftp://ftp.suse.com/pub/suse/sparc/update/7.1/n3/hylafax-4.1beta2-218.s parc.rpm


• S.u.S.E. hylafax-4.1beta2-244.alpha.rpm
  ftp://ftp.suse.com/pub/suse/axp/update/7.0/n2/hylafax-4.1beta2-244.alp ha.rpm


• S.u.S.E. hylafax-4.1beta2-245.alpha.rpm
  ftp://ftp.suse.com/pub/suse/axp/update/7.1/n3/hylafax-4.1beta2-245.alp ha.rpm


• S.u.S.E. hylafax-4.1beta2-373.i386.rpm
  ftp://ftp.suse.com/pub/suse/i386/update/7.0/n2/hylafax-4.1beta2-373.i3 86.rpm


• S.u.S.E. hylafax-4.1beta2-375.i386.rpm
  ftp://ftp.suse.com/pub/suse/i386/update/7.1/n3/hylafax-4.1beta2-375.i3 86.rpm


• S.u.S.E. hylafax-4.1beta2-376.i386.rpm
  ftp://ftp.suse.com/pub/suse/i386/update/7.2/n3/hylafax-4.1beta2-376.i3 86.rpm

Hylafax Hylafax 4.1

• Hylafax hylafax-4.1.3.tar.gz
  ftp://ftp.hylafax.org/source/hylafax-4.1.3.tar.gz


• Mandrake hylafax-4.1-0.11mdk.i586.rpm
  Linux-Mandrake 7.1.
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake hylafax-4.1-0.11mdk.i586.rpm
  Linux-Mandrake 7.2.
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake hylafax-4.1-0.11mdk.i586.rpm
  Mandrake Corporate Server 1.0.1.
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake hylafax-4.1.3-1.1mdk.i586.rpm
  Mandrake Linux 8.0.
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake hylafax-4.1.3-1.1mdk.i586.rpm
  Mandrake Linux 8.1.
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake hylafax-4.1.3-1.1mdk.i586.rpm
  Mandrake Linux 8.2.
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake hylafax-4.1.3-1.1mdk.ia64.rpm
  Mandrake Linux 8.1/ia64.
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake hylafax-4.1.3-1.1mdk.ppc.rpm
  Mandrake Linux 8.0/ppc.
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake hylafax-4.1.3-1.1mdk.ppc.rpm
  Mandrake Linux 8.2/ppc.
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake hylafax-client-4.1-0.11mdk.i586.rpm
  Linux-Mandrake 7.1.
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake hylafax-client-4.1-0.11mdk.i586.rpm
  Linux-Mandrake 7.2.
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake hylafax-client-4.1-0.11mdk.i586.rpm
  Mandrake Corporate Server 1.0.1.
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake hylafax-client-4.1.3-1.1mdk.i586.rpm
  Mandrake Linux 8.0.
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake hylafax-client-4.1.3-1.1mdk.i586.rpm
  Mandrake Linux 8.1.
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake hylafax-client-4.1.3-1.1mdk.i586.rpm
  Mandrake Linux 8.2.
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake hylafax-client-4.1.3-1.1mdk.ia64.rpm
  Mandrake Linux 8.1/ia64.
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake hylafax-client-4.1.3-1.1mdk.ppc.rpm
  Mandrake Linux 8.0/ppc.
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake hylafax-client-4.1.3-1.1mdk.ppc.rpm
  Mandrake Linux 8.2/ppc.
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake hylafax-server-4.1-0.11mdk.i586.rpm
  Linux-Mandrake 7.1.
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake hylafax-server-4.1-0.11mdk.i586.rpm
  Linux-Mandrake 7.2.
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake hylafax-server-4.1-0.11mdk.i586.rpm
  Mandrake Corporate Server 1.0.1.
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake hylafax-server-4.1.3-1.1mdk.i586.rpm
  Mandrake Linux 8.0.
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake hylafax-server-4.1.3-1.1mdk.i586.rpm
  Mandrake Linux 8.1.
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake hylafax-server-4.1.3-1.1mdk.i586.rpm
  Mandrake Linux 8.2.
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake hylafax-server-4.1.3-1.1mdk.ia64.rpm
  Mandrake Linux 8.1/ia64.
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake hylafax-server-4.1.3-1.1mdk.ppc.rpm
  Mandrake Linux 8.0/ppc.
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake hylafax-server-4.1.3-1.1mdk.ppc.rpm
  Mandrake Linux 8.2/ppc.
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake libhylafax4.1.1-4.1.3-1.1mdk.i586.rpm
  Mandrake Linux 8.0.
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake libhylafax4.1.1-4.1.3-1.1mdk.i586.rpm
  Mandrake Linux 8.1.
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake libhylafax4.1.1-4.1.3-1.1mdk.i586.rpm
  Mandrake Linux 8.2.
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake libhylafax4.1.1-4.1.3-1.1mdk.ia64.rpm
  Mandrake Linux 8.1/ia64.
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake libhylafax4.1.1-4.1.3-1.1mdk.ppc.rpm
  Mandrake Linux 8.0/ppc.
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake libhylafax4.1.1-4.1.3-1.1mdk.ppc.rpm
  Mandrake Linux 8.2/ppc.
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake libhylafax4.1.1-devel-4.1.3-1.1mdk.i586.rpm
  Mandrake Linux 8.0.
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake libhylafax4.1.1-devel-4.1.3-1.1mdk.i586.rpm
  Mandrake Linux 8.1.
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake libhylafax4.1.1-devel-4.1.3-1.1mdk.i586.rpm
  Mandrake Linux 8.2.
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake libhylafax4.1.1-devel-4.1.3-1.1mdk.ia64.rpm
  Mandrake Linux 8.1/ia64.
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake libhylafax4.1.1-devel-4.1.3-1.1mdk.ppc.rpm
  Mandrake Linux 8.0/ppc.
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake libhylafax4.1.1-devel-4.1.3-1.1mdk.ppc.rpm
  Mandrake Linux 8.2/ppc.
  http://www.mandrakesecure.net/en/ftp.php


• S.u.S.E. hylafax-4.1-112.sparc.rpm
  ftp://ftp.suse.com/pub/suse/sparc/update/7.3/n3/hylafax-4.1-112.sparc. rpm


• S.u.S.E. hylafax-4.1-189.ppc.rpm
  ftp://ftp.suse.com/pub/suse/ppc/update/7.3/n3/hylafax-4.1-189.ppc.rpm


• S.u.S.E. hylafax-4.1-284.i386.rpm
  ftp://ftp.suse.com/pub/suse/i386/update/7.3/n3/hylafax-4.1-284.i386.rp m


• S.u.S.E. hylafax-4.1-285.i386.patch.rpm
  ftp://ftp.suse.com/pub/suse/i386/update/8.0/n4/hylafax-4.1-285.i386.pa tch.rpm


• S.u.S.E. hylafax-4.1-285.i386.rpm
  ftp://ftp.suse.com/pub/suse/i386/update/8.0/n4/hylafax-4.1-285.i386.rp m

Hylafax Hylafax 4.1.1

• Debian hylafax-client_4.0.2-14.3_powerpc.deb
  http://security.debian.org/pool/updates/main/h/hylafax/hylafax-client_ 4.0.2-14.3_powerpc.deb


• Debian hylafax-client_4.0.2-14.3_sparc.deb
  http://security.debian.org/pool/updates/main/h/hylafax/hylafax-client_ 4.0.2-14.3_sparc.deb


• Debian hylafax-client_4.1.1-1.1_alpha.deb
  http://security.debian.org/pool/updates/main/h/hylafax/hylafax-client_ 4.1.1-1.1_alpha.deb


• Debian hylafax-client_4.1.1-1.1_arm.deb
  http://security.debian.org/pool/updates/main/h/hylafax/hylafax-client_ 4.1.1-1.1_arm.deb


• Debian hylafax-client_4.1.1-1.1_hppa.deb
  http://security.debian.org/pool/updates/main/h/hylafax/hylafax-client_ 4.1.1-1.1_hppa.deb


• Debian hylafax-client_4.1.1-1.1_i386.deb
  http://security.debian.org/pool/updates/main/h/hylafax/hylafax-client_ 4.1.1-1.1_i386.deb


• Debian hylafax-client_4.1.1-1.1_ia64.deb
  http://security.debian.org/pool/updates/main/h/hylafax/hylafax-client_ 4.1.1-1.1_ia64.deb


• Debian hylafax-client_4.1.1-1.1_m68k.deb
  http://security.debian.org/pool/updates/main/h/hylafax/hylafax-client_ 4.1.1-1.1_m68k.deb


• Debian hylafax-client_4.1.1-1.1_powerpc.deb
  http://security.debian.org/pool/updates/main/h/hylafax/hylafax-client_ 4.1.1-1.1_powerpc.deb


• Debian hylafax-client_4.1.1-1.1_s390.deb
  http://security.debian.org/pool/updates/main/h/hylafax/hylafax-client_ 4.1.1-1.1_s390.deb


• Debian hylafax-client_4.1.1-1.1_sparc.deb
  http://security.debian.org/pool/updates/main/h/hylafax/hylafax-client_ 4.1.1-1.1_sparc.deb


• Debian hylafax-doc_4.1.1-1.1_all.deb
  http://security.debian.org/pool/updates/main/h/hylafax/hylafax-doc_4.1 .1-1.1_all.deb


• Debian hylafax-server_4.0.2-14.3_powerpc.deb
  http://security.debian.org/pool/updates/main/h/hylafax/hylafax-server_ 4.0.2-14.3_powerpc.deb


• Debian hylafax-server_4.0.2-14.3_sparc.deb
  http://security.debian.org/pool/updates/main/h/hylafax/hylafax-server_ 4.0.2-14.3_sparc.deb


• Debian hylafax-server_4.1.1-1.1_alpha.deb
  http://security.debian.org/pool/updates/main/h/hylafax/hylafax-server_ 4.1.1-1.1_alpha.deb


• Debian hylafax-server_4.1.1-1.1_arm.deb
  http://security.debian.org/pool/updates/main/h/hylafax/hylafax-server_ 4.1.1-1.1_arm.deb


• Debian hylafax-server_4.1.1-1.1_hppa.deb
  http://security.debian.org/pool/updates/main/h/hylafax/hylafax-server_ 4.1.1-1.1_hppa.deb


• Debian hylafax-server_4.1.1-1.1_i386.deb
  http://security.debian.org/pool/updates/main/h/hylafax/hylafax-server_ 4.1.1-1.1_i386.deb


• Debian hylafax-server_4.1.1-1.1_ia64.deb
  http://security.debian.org/pool/updates/main/h/hylafax/hylafax-server_ 4.1.1-1.1_ia64.deb


• Debian hylafax-server_4.1.1-1.1_m68k.deb
  http://security.debian.org/pool/updates/main/h/hylafax/hylafax-server_ 4.1.1-1.1_m68k.deb


• Debian hylafax-server_4.1.1-1.1_powerpc.deb
  http://security.debian.org/pool/updates/main/h/hylafax/hylafax-server_ 4.1.1-1.1_powerpc.deb


• Debian hylafax-server_4.1.1-1.1_s390.deb
  http://security.debian.org/pool/updates/main/h/hylafax/hylafax-server_ 4.1.1-1.1_s390.deb


• Debian hylafax-server_4.1.1-1.1_sparc.deb
  http://security.debian.org/pool/updates/main/h/hylafax/hylafax-server_ 4.1.1-1.1_sparc.deb


• Hylafax hylafax-4.1.3.tar.gz
  ftp://ftp.hylafax.org/source/hylafax-4.1.3.tar.gz

Hylafax Hylafax 4.1.2

• Hylafax hylafax-4.1.3.tar.gz
  ftp://ftp.hylafax.org/source/hylafax-4.1.3.tar.gz

Hylafax Incoming TSI Format String Denial Of Service Vulnerability

References:

• Hylafax Homepage (Hylafax)