How to handle Sylpheed-Claws POP3 Remote Format String Processing Vulnerability

SylpheedA good email client also has vulnerabilities. Please refer to the following section.

Affected Systems:

Sylpheed 2.4.4

Sylpheed-Claws 2.10.0

Sylpheed-Claws 1.9.100

Description:

Bugtraq id: 25430

CVE (CAN) ID: CVE-2007-2958

Both Sylpheed and Sylpheed-Claws are lightweight mail clients.

Sylpheed and Sylpheed-Claws have a format string processing vulnerability in processing user requests. Remote attackers may exploit this vulnerability to control the client.

Src/inc. the inc_put_error () function in file c has a format string vulnerability when displaying the POP3 server error response. If the user is cheated to connect to a malicious POP3 server and receives a response containing a format identifier, this vulnerability may be triggered and arbitrary commands may be executed.

<* Source: Ulf Harnhammar (ulfh@update.uu.se)

Link: http://secunia.com/secunia_research/2007-70/advisory/

Http://security.gentoo.org/glsa/glsa-200710-29.xml

*>

Suggestion:

Vendor patch:

Gentoo

------

Gentoo released a Security Bulletin (GLSA-200710-29) and patches:

GLSA-200710-29: Sylpheed, Claws Mail: User-Defined ed remote execution

Link: http://security.gentoo.org/glsa/glsa-200710-29.xml

All Sylpheed users should upgrade to the latest version:

# Emerge -- sync

# Emerge -- ask -- oneshot -- verbose "> = mail-client/sylpheed-2.4.5"

All Claws Mail users should upgrade to the latest version:

# Emerge -- sync

# Emerge -- ask -- oneshot -- verbose "> = mail-client/claws-mail-3.0.0"

Sylpheed

--------

The vendor has released an upgrade patch to fix this security problem. Please download it from the vendor's homepage:

Http://sylpheed.sraoss.jp/en/

I hope you read this article and fix the vulnerability quickly!