Your message dated Wed, 10 Apr 2002 17:47:21 -0400
with message-id <[EMAIL PROTECTED]>
and subject line Bug#129104: fixed in cgiemail 1.6-14
has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere. Please contact me immediately.)
Debian bug tracking system administrator
(administrator, Debian Bugs database)
--------------------------------------
Received: (at submit) by bugs.debian.org; 14 Jan 2002 02:22:18 +0000
>From [EMAIL PROTECTED] Sun Jan 13 20:22:18 2002
Return-path: <[EMAIL PROTECTED]>
Received: from chcgil2-ar3-4-60-058-141.vz.dsl.gtei.net (tap.homenet)
[4.60.58.141]
by master.debian.org with esmtp (Exim 3.12 1 (Debian))
id 16PwlO-0002sA-00; Sun, 13 Jan 2002 20:22:18 -0600
Received: by tap.homenet (Postfix, from userid 1000)
id 6A3362D2D8; Sun, 13 Jan 2002 21:22:17 -0500 (EST)
From: thomas smith <[EMAIL PROTECTED]>
To: Debian Bug Tracking System <[EMAIL PROTECTED]>
Subject: cgiemail: buffer overflow and script reading vulnerabilities
X-Reportbug-Version: 1.41.14213
X-Mailer: reportbug 1.41.14213
Date: Sun, 13 Jan 2002 21:22:17 -0500
Message-Id: <[EMAIL PROTECTED]>
Delivered-To: [EMAIL PROTECTED]
Package: cgiemail
Version: 1.6-8
Severity: critical
Tags: security
Justification: root security hole
I maintain CGIEMAIL. I can't write C, the language it is written in.
There are two problems, one which should be easy to fix and one which
may require major changes. One, buffer overflow. May be found on line
185 of cgilibcso.c (the sprintf statement). Two, script reading. If
you know what the index of an array variable looks like in a script, you
can read it because cgiemail thinks it's a template file. This can also
work with character classes in regular expressions. It just needs to
have a [ and a ] in it, and you need to know what's in between.
So if someone feels like helping, that'd be very nice. Don't want this
package in woody unless someone fixes.
-- System Information
Debian Release: 3.0
Architecture: i386
Kernel: Linux tap 2.4.17 #2 Sat Jan 5 22:37:38 EST 2002 i686
Locale: LANG=C, LC_CTYPE=C
Versions of packages cgiemail depends on:
ii libc6 2.2.4-7 GNU C Library: Shared libraries an
---------------------------------------
Received: (at 129104-close) by bugs.debian.org; 10 Apr 2002 21:58:33 +0000
>From [EMAIL PROTECTED] Wed Apr 10 16:58:33 2002
Return-path: <[EMAIL PROTECTED]>
Received: from auric.debian.org [206.246.226.45] (mail)
by master.debian.org with esmtp (Exim 3.12 1 (Debian))
id 16vQ6r-0006p1-00; Wed, 10 Apr 2002 16:58:33 -0500
Received: from katie by auric.debian.org with local (Exim 3.12 1 (Debian))
id 16vPw1-00025E-00; Wed, 10 Apr 2002 17:47:21 -0400
From: Thomas Smith <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
X-Katie: $Revision: 1.10 $
Subject: Bug#129104: fixed in cgiemail 1.6-14
Message-Id: <[EMAIL PROTECTED]>
Sender: Archive Administrator <[EMAIL PROTECTED]>
Date: Wed, 10 Apr 2002 17:47:21 -0400
Delivered-To: [EMAIL PROTECTED]
We believe that the bug you reported is fixed in the latest version of
cgiemail, which is due to be installed in the Debian FTP archive:
cgiemail_1.6-14.diff.gz
to pool/main/c/cgiemail/cgiemail_1.6-14.diff.gz
cgiemail_1.6-14.dsc
to pool/main/c/cgiemail/cgiemail_1.6-14.dsc
cgiemail_1.6-14_i386.deb
to pool/main/c/cgiemail/cgiemail_1.6-14_i386.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [EMAIL PROTECTED],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Thomas Smith <[EMAIL PROTECTED]> (supplier of updated cgiemail package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [EMAIL PROTECTED])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.7
Date: Tue, 9 Apr 2002 21:52:17 -0500
Source: cgiemail
Binary: cgiemail
Architecture: source i386
Version: 1.6-14
Distribution: unstable
Urgency: high
Maintainer: Debian QA Group <[EMAIL PROTECTED]>
Changed-By: Thomas Smith <[EMAIL PROTECTED]>
Description:
cgiemail - CGI Form-to-Mail converter
Closes: 129104
Changes:
cgiemail (1.6-14) unstable; urgency=high
.
* fixed up the debconf stuff again, this time it's Right.
* upped standards-version
* added perl to build-depends because i use pod2man.
* This version will finally be released, so can do this:
Closes: Bug#129104. Fixes security vulnerabilities.
* Thanks, Colin Watson.
Files:
164a6bd1a8250d1cf6f7ada2bd798e63 571 web optional cgiemail_1.6-14.dsc
37b4cf8edc13f5154bd718e1dad50227 13072 web optional cgiemail_1.6-14.diff.gz
9681df1cb7cd31a7bb0ac4e3074349ae 31648 web optional cgiemail_1.6-14_i386.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
iEYEARECAAYFAjy0sLIACgkQ/xuE/qyrqB4KqgCeImw75ZdId8jnvVhsOltm+V7z
pMcAoJeRjM3cMs0Mgp08bS+8lf0nZ2F0
=uZ57
-----END PGP SIGNATURE-----
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
