Vulnerabilities > CVE-2017-16844 - Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Procmail 3.22

047910
CVSS 10.0 - CRITICAL
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
low complexity
procmail
CWE-119
critical
nessus

Summary

Heap-based buffer overflow in the loadbuf function in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted e-mail message because of a hardcoded realloc size, a different vulnerability than CVE-2014-3618.

Vulnerable Configurations

Part Description Count
Application
Procmail
1

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Buffer Overflow via Environment Variables
    This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
  • Overflow Buffers
    Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
  • Client-side Injection-induced Buffer Overflow
    This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
  • Filter Failure through Buffer Overflow
    In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
  • MIME Conversion
    An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.

Nessus

  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-3483-1.NASL
    descriptionJakub Wilk discovered that the formail tool incorrectly handled certain malformed mail messages. An attacker could use this flaw to cause formail to crash, resulting in a denial of service, or possibly execute arbitrary code. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id104713
    published2017-11-21
    reporterUbuntu Security Notice (C) 2017-2019 Canonical, Inc. / NASL script (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/104713
    titleUbuntu 14.04 LTS / 16.04 LTS / 17.04 / 17.10 : procmail vulnerability (USN-3483-1)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2017-1317.NASL
    descriptionAccording to the version of the procmail package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The procmail packages contain a mail processing tool that can be used to create mail servers, mailing lists, sort incoming mail into separate folders or files, preprocess mail, start any program upon mail arrival, or automatically forward selected incoming mail.(CVE-2017-16844) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-06
    modified2017-12-01
    plugin id104935
    published2017-12-01
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/104935
    titleEulerOS 2.0 SP2 : procmail (EulerOS-SA-2017-1317)
  • NASL familyPhotonOS Local Security Checks
    NASL idPHOTONOS_PHSA-2017-0051_PYTHON2.NASL
    descriptionAn update of the python2 package has been released.
    last seen2020-03-17
    modified2019-02-07
    plugin id121774
    published2019-02-07
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/121774
    titlePhoton OS 2.0: Python2 PHSA-2017-0051
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2017-3269.NASL
    descriptionAn update for procmail is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The procmail packages contain a mail processing tool that can be used to create mail servers, mailing lists, sort incoming mail into separate folders or files, preprocess mail, start any program upon mail arrival, or automatically forward selected incoming mail. Security Fix(es) : * A heap-based buffer overflow flaw was found in procmail
    last seen2020-06-01
    modified2020-06-02
    plugin id104817
    published2017-11-29
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/104817
    titleCentOS 7 : procmail (CESA-2017:3269)
  • NASL familyPhotonOS Local Security Checks
    NASL idPHOTONOS_PHSA-2017-0052.NASL
    descriptionAn update of [rsync,python2,procmail,libvirt,linux,mongodb,openssh,binutils,glibc] packages for photonOS has been released.
    last seen2019-02-21
    modified2019-02-07
    plugin id111901
    published2018-08-17
    reporterTenable
    sourcehttps://www.tenable.com/plugins/index.php?view=single&id=111901
    titlePhoton OS 1.0: Binutils / Glibc / Linux / Mongodb / Openssh / Procmail / Python2 / Rsync PHSA-2017-0052 (deprecated)
  • NASL familyNewStart CGSL Local Security Checks
    NASL idNEWSTART_CGSL_NS-SA-2019-0005_PROCMAIL.NASL
    descriptionThe remote NewStart CGSL host, running version MAIN 5.04, has procmail packages installed that are affected by a vulnerability: - A heap-based buffer overflow flaw was found in procmail
    last seen2020-06-01
    modified2020-06-02
    plugin id127148
    published2019-08-12
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/127148
    titleNewStart CGSL MAIN 5.04 : procmail Vulnerability (NS-SA-2019-0005)
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_288F7CEECED611E78AE90050569F0B83.NASL
    descriptionMITRE reports : A remote attacker could use a flaw to cause formail to crash, resulting in a denial of service or data loss.
    last seen2020-06-01
    modified2020-06-02
    plugin id104731
    published2017-11-22
    reporterThis script is Copyright (C) 2017-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/104731
    titleFreeBSD : procmail -- Heap-based buffer overflow (288f7cee-ced6-11e7-8ae9-0050569f0b83)
  • NASL familyVirtuozzo Local Security Checks
    NASL idVIRTUOZZO_VZLSA-2017-3269.NASL
    descriptionAn update for procmail is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The procmail packages contain a mail processing tool that can be used to create mail servers, mailing lists, sort incoming mail into separate folders or files, preprocess mail, start any program upon mail arrival, or automatically forward selected incoming mail. Security Fix(es) : * A heap-based buffer overflow flaw was found in procmail
    last seen2020-06-01
    modified2020-06-02
    plugin id119238
    published2018-11-27
    reporterThis script is Copyright (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/119238
    titleVirtuozzo 7 : procmail (VZLSA-2017-3269)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2017-1316.NASL
    descriptionAccording to the version of the procmail package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The procmail packages contain a mail processing tool that can be used to create mail servers, mailing lists, sort incoming mail into separate folders or files, preprocess mail, start any program upon mail arrival, or automatically forward selected incoming mail.(CVE-2017-16844) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-06
    modified2017-12-01
    plugin id104934
    published2017-12-01
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/104934
    titleEulerOS 2.0 SP1 : procmail (EulerOS-SA-2017-1316)
  • NASL familyPhotonOS Local Security Checks
    NASL idPHOTONOS_PHSA-2017-0051_RSYNC.NASL
    descriptionAn update of the rsync package has been released.
    last seen2020-03-17
    modified2019-02-07
    plugin id121775
    published2019-02-07
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/121775
    titlePhoton OS 2.0: Rsync PHSA-2017-0051
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2017-3231-1.NASL
    descriptionThis update for procmail fixes the following issues: Security issue fixed : - CVE-2017-16844: Heap-based buffer overflow in the loadbuf function in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted e-mail message because of a hard-coded realloc size, a different vulnerability than CVE-2014-3618. (bnc#1068648) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id105094
    published2017-12-08
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/105094
    titleSUSE SLES11 Security Update : procmail (SUSE-SU-2017:3231-1)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2017-3269.NASL
    descriptionFrom Red Hat Security Advisory 2017:3269 : An update for procmail is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The procmail packages contain a mail processing tool that can be used to create mail servers, mailing lists, sort incoming mail into separate folders or files, preprocess mail, start any program upon mail arrival, or automatically forward selected incoming mail. Security Fix(es) : * A heap-based buffer overflow flaw was found in procmail
    last seen2020-06-01
    modified2020-06-02
    plugin id104837
    published2017-11-29
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/104837
    titleOracle Linux 7 : procmail (ELSA-2017-3269)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20171129_PROCMAIL_ON_SL7_X.NASL
    descriptionSecurity Fix(es) : - A heap-based buffer overflow flaw was found in procmail
    last seen2020-03-18
    modified2017-11-30
    plugin id104867
    published2017-11-30
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/104867
    titleScientific Linux Security Update : procmail on SL7.x x86_64 (20171129)
  • NASL familyPhotonOS Local Security Checks
    NASL idPHOTONOS_PHSA-2017-0051_LINUX.NASL
    descriptionAn update of the linux package has been released.
    last seen2020-03-17
    modified2019-02-07
    plugin id121771
    published2019-02-07
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/121771
    titlePhoton OS 2.0: Linux PHSA-2017-0051
  • NASL familyPhotonOS Local Security Checks
    NASL idPHOTONOS_PHSA-2017-0051_OPENSSH.NASL
    descriptionAn update of the openssh package has been released.
    last seen2020-03-17
    modified2019-02-07
    plugin id121772
    published2019-02-07
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/121772
    titlePhoton OS 2.0: Openssh PHSA-2017-0051
  • NASL familyPhotonOS Local Security Checks
    NASL idPHOTONOS_PHSA-2017-0051.NASL
    descriptionAn update of [rsync,linux,openssh,procmail,python2,libvirt] packages for PhotonOS has been released.
    last seen2019-02-21
    modified2019-02-07
    plugin id111900
    published2018-08-17
    reporterTenable
    sourcehttps://www.tenable.com/plugins/index.php?view=single&id=111900
    titlePhoton OS 2.0: Libvirt / Linux / Openssh / Procmail / Python2 / Rsync PHSA-2017-0051 (deprecated)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2017-3269.NASL
    descriptionAn update for procmail is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The procmail packages contain a mail processing tool that can be used to create mail servers, mailing lists, sort incoming mail into separate folders or files, preprocess mail, start any program upon mail arrival, or automatically forward selected incoming mail. Security Fix(es) : * A heap-based buffer overflow flaw was found in procmail
    last seen2020-06-01
    modified2020-06-02
    plugin id104841
    published2017-11-29
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/104841
    titleRHEL 7 : procmail (RHSA-2017:3269)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2018-0173-1.NASL
    descriptionThis update for procmail fixes the following issues : - CVE-2017-16844: Heap-based buffer overflow in loadbuf function could lead to remote denial of service (bsc#1068648) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id106262
    published2018-01-23
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/106262
    titleSUSE SLED12 / SLES12 Security Update : procmail (SUSE-SU-2018:0173-1)
  • NASL familyAmazon Linux Local Security Checks
    NASL idALA_ALAS-2018-1084.NASL
    descriptionA heap-based buffer overflow flaw was found in procmail
    last seen2020-06-01
    modified2020-06-02
    plugin id117608
    published2018-09-20
    reporterThis script is Copyright (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/117608
    titleAmazon Linux AMI : procmail (ALAS-2018-1084)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-4041.NASL
    descriptionJakub Wilk reported a heap-based buffer overflow vulnerability in procmail
    last seen2020-06-01
    modified2020-06-02
    plugin id104685
    published2017-11-20
    reporterThis script is Copyright (C) 2017-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/104685
    titleDebian DSA-4041-1 : procmail - security update
  • NASL familyPhotonOS Local Security Checks
    NASL idPHOTONOS_PHSA-2017-0051_PROCMAIL.NASL
    descriptionAn update of the procmail package has been released.
    last seen2020-03-17
    modified2019-02-07
    plugin id121773
    published2019-02-07
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/121773
    titlePhoton OS 2.0: Procmail PHSA-2017-0051
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-1173.NASL
    descriptionIt was discovered that there was a heap-based buffer overflow in procmail, a tool used to sort incoming mail into various directories and filter out spam messages. For Debian 7
    last seen2020-03-17
    modified2017-11-20
    plugin id104676
    published2017-11-20
    reporterThis script is Copyright (C) 2017-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/104676
    titleDebian DLA-1173-1 : procmail security update

Redhat

advisories
bugzilla
id1500070
titleCVE-2017-16844 procmail: Heap-based buffer overflow in loadbuf function in formisc.c
oval
OR
  • commentRed Hat Enterprise Linux must be installed
    ovaloval:com.redhat.rhba:tst:20070304026
  • AND
    • commentRed Hat Enterprise Linux 7 is installed
      ovaloval:com.redhat.rhba:tst:20150364027
    • commentprocmail is earlier than 0:3.22-36.el7_4.1
      ovaloval:com.redhat.rhsa:tst:20173269001
    • commentprocmail is signed with Red Hat redhatrelease2 key
      ovaloval:com.redhat.rhsa:tst:20141172005
rhsa
idRHSA-2017:3269
released2017-11-28
severityImportant
titleRHSA-2017:3269: procmail security update (Important)
rpms
  • procmail-0:3.22-36.el7_4.1
  • procmail-debuginfo-0:3.22-36.el7_4.1