Qualcomm qpopper Remote Buffer Overflow Vulnerability

Bugtraq ID:	830
Class:	Boundary Condition Error
CVE:	CVE-1999-0822
Remote:	Yes
Local:	No
Published:	Nov 30 1999 12:00AM
Updated:	Jul 11 2009 12:56AM
Credit:	First posted to BugTraq by Mixter <[email protected]> on Nov 30, 1999.
Vulnerable:	Qualcomm qpopper 3.0 b20 Qualcomm qpopper 3.0
Not Vulnerable:	Qualcomm qpopper 2.53 Qualcomm qpopper 2.52 Qualcomm qpopper 2.4

Qualcomm qpopper Remote Buffer Overflow Vulnerability

An exploit has been made available.

• /data/vulnerabilities/exploits/qpopper3exp.c
• /data/vulnerabilities/exploits/qpop.sh
• /data/vulnerabilities/exploits/qpop.pl

Qualcomm qpopper Remote Buffer Overflow Vulnerability

Solution:
The newest version, qpopper3.0b22 (which is patched), is available at:

ftp://ftp.qualcomm.com/eudora/servers/unix/popper/

This is a temporary patch, provided by Mixter <[email protected]> in his post to BugTraq.
# apply this in the qpopper3.0b20/popper/ directory with patch < qp3b20.patch
--- pop_msg.c.old Mon Nov 29 23:42:03 1999
+++ pop_msg.c Mon Nov 29 23:52:08 1999
@@ -65,7 +65,7 @@
/* Append the message (formatted, if necessary) */
if (format) {
#ifdef HAVE_VPRINTF
- vsprintf(mp,format,ap);
+ vsnprintf(mp,MAXLINELEN - 100, format,ap);
#else
# ifdef PYRAMID
arg1 = va_arg(ap, char *);
@@ -74,9 +74,9 @@
arg4 = va_arg(ap, char *);
arg5 = va_arg(ap, char *);
arg6 = va_arg(ap, char *);
- (void)sprintf(mp,format, arg1, arg2, arg3, arg4, arg5, arg6);
+ (void)sprintf(mp,MAXLINELEN - 100, format, arg1, arg2, arg3, arg4, arg5, arg6);
# else
- (void)sprintf(mp,format,((int *)ap)[0],((int *)ap)[1],((int *)ap)[2],
+ (void)sprintf(mp,MAXLINELEN - 100, format,((int *)ap)[0],((int *)ap)[1],((int *)ap)[2],
((int *)ap)[3],((int *)ap)[4]);
# endif
#endif