Debian has issued an advisory on December 11: http://www.debian.org/security/2012/dsa-2585 Cauldron is not affected as it was fixed upstream in 1.2.3, which we have. Patched package uploaded for Mageia 2. Advisory: ======================== Updated bogofilter package fixes security vulnerability: In bogofilter before 1.2.3, bogofilter's/bogolexer's base64 could overwrite heap memory in the character set conversion in certain pathological cases of invalid base64 code that decodes to incomplete multibyte characters (CVE-2012-5468). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5468 http://bogofilter.sourceforge.net/security/bogofilter-SA-2012-01 http://www.debian.org/security/2012/dsa-2585 ======================== Updated packages in core/updates_testing: ======================== bogofilter-1.2.2-2.1.mga2 from bogofilter-1.2.2-2.1.mga2.src.rpm
Was the test for this included in the build David? http://bogofilter.svn.sourceforge.net/viewvc/bogofilter?view=revision&revision=6975
Created attachment 3240 [details] script to create PoC Testing complete mga2 64 using the attached script. Adapted from the build test http://bogofilter.svn.sourceforge.net/viewvc/bogofilter/trunk/bogofilter/src/tests/t.crash-invalid-base64?revision=6975&pathrev=6975 bogofilter complains about not having a wordlist when first started so created one with.. $ bogofilter -s viagra porn ctrl-c ctrl-c Ran the adapted script attached here to create spam.txt Before ------ $ bogofilter -I spam.txt *** glibc detected *** bogofilter: realloc(): invalid next size: 0x00000000018161b0 *** Had to close the terminal to quit, it didn't respond to ctrl-c After ----- $ bogofilter -I spam.txt $ Returns to a prompt without error.
Whiteboard: (none) => has_procedure mga2-64-OK
(In reply to comment #1) > Was the test for this included in the build David? > > http://bogofilter.svn.sourceforge.net/viewvc/bogofilter?view=revision&revision=6975 No, good find. Would you like me to add it?
May as well I think David, it's easy to test so repeating shouldn't cause any delay.
Test added, but there's a build system issue and I don't know if it'll ever finish. If it does, it'll be bogofilter-1.2.2-2.1.mga2.
Seems the poc only causes a problem on 64 bit systems. On i586, it works ok both before and after the update. Could someone from the sysadmin team push the srpm bogofilter-1.2.2-2.1.mga2.src.rpm from Mageia 2 Core Updates Testing to Core Updates. Advisory: Updated bogofilter package fixes security vulnerability: In bogofilter before 1.2.3, bogofilter's/bogolexer's base64 could overwrite heap memory in the character set conversion in certain pathological cases of invalid base64 code that decodes to incomplete multibyte characters (CVE-2012-5468). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5468 http://bogofilter.sourceforge.net/security/bogofilter-SA-2012-01 http://www.debian.org/security/2012/dsa-2585 https://bugs.mageia.org/show_bug.cgi?id=8376
Keywords: (none) => validated_updateCC: (none) => davidwhodgins, sysadmin-bugsWhiteboard: has_procedure mga2-64-OK => has_procedure mga2-64-OK MGA2-32-OK
bogofilter-1.2.2-2.2.mga2 finally got built/uploaded some 1,5 h ago after a "gazillion" chroot install rounds... So I guess the validation is not valid anymore...
CC: (none) => tmb
Keywords: validated_update => (none)Whiteboard: has_procedure mga2-64-OK MGA2-32-OK => has_procedure
retested mga2 64 OK
Whiteboard: has_procedure => has_procedure mga2-64-OK
Testing complete on Mageia 2 i586. Could someone from the sysadmin team push the srpm bogofilter-1.2.2-2.2.mga2.src.rpm from Mageia 2 Core Updates Testing to Core Updates. Advisory: Updated bogofilter package fixes security vulnerability: In bogofilter before 1.2.3, bogofilter's/bogolexer's base64 could overwrite heap memory in the character set conversion in certain pathological cases of invalid base64 code that decodes to incomplete multibyte characters (CVE-2012-5468). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5468 http://bogofilter.sourceforge.net/security/bogofilter-SA-2012-01 http://www.debian.org/security/2012/dsa-2585 https://bugs.mageia.org/show_bug.cgi?id=8376
Keywords: (none) => validated_updateWhiteboard: has_procedure mga2-64-OK => has_procedure mga2-64-OK MGA2-32-OK
Update pushed: https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0363
Status: NEW => RESOLVEDResolution: (none) => FIXED
Patch checked into Mageia 1 SVN.