A heap-based buffer overflow flaw was found in the way bogolexer component of Bogofilter, fast anti-spam filtering tool by Bayesian statistical analysis, performed decoding of certain base64 strings. A remote attacker could provide a specially-crafted base64 code (decoding to incomplete multibyte characters) that, when processed, would lead to bogolexer executable crash or, potentially, arbitrary code execution with the privileges of the user running the binary.

Upstream advisory: [1] http://bogofilter.sourceforge.net/security/bogofilter-SA-2012-01

References: [2] http://www.openwall.com/lists/oss-security/2012/12/03/13

Relevant upstream patch: [3] http://bogofilter.svn.sourceforge.net/viewvc/bogofilter?view=revision&revision=6973

Reproducer / regression test: [4] http://bogofilter.svn.sourceforge.net/viewvc/bogofilter?view=revision&revision=6975

A flaw was found in bogofilter's/bogolexer's base64 where it could overwrite memory before its heap buffer, if the base64 input started with an equals sign, such as through misdeclaration of quoted-printable as base64. This would cause bogofilter/bogolexer to corrupt their heap and crash upon receiving such an email message.

Something is wrong with the bogofilter home page, the original referenced advisory [1] is currently unavailable, however a copy in svn [2] is. This will also be corrected in upstream version 1.2.2; a patch [3] is available. Please note that upstream version 1.2.2 is not yet available.

References:

[1] http://bogofilter.sourceforge.net/security/bogofilter-SA-2010-01 [2] http://bogofilter.svn.sourceforge.net/viewvc/bogofilter/trunk/bogofilter/doc/bogofilter-SA-2010-01?view=markup&pathrev=6909 [3] http://bogofilter.svn.sourceforge.net/viewvc/bogofilter/trunk/bogofilter/src/base64.c?view=patch&r1=6906&r2=6903

This affects bogofilter as shipped in Fedora 12 and 13, as well as EPEL5.

A flaw was found in bogofilter's/bogolexer's base64 where it could overwrite memory before its heap buffer, if the base64 input started with an equals sign, such as through misdeclaration of quoted-printable as base64. This would cause bogofilter/bogolexer to corrupt their heap and crash upon receiving such an email message.

Something is wrong with the bogofilter home page, the original referenced advisory [1] is currently unavailable, however a copy in svn [2] is. This will also be corrected in upstream version 1.2.2; a patch [3] is available. Please note that upstream version 1.2.2 is not yet available.

References:

[1] http://bogofilter.sourceforge.net/security/bogofilter-SA-2010-01 [2] http://bogofilter.svn.sourceforge.net/viewvc/bogofilter/trunk/bogofilter/doc/bogofilter-SA-2010-01?view=markup&pathrev=6909 [3] http://bogofilter.svn.sourceforge.net/viewvc/bogofilter/trunk/bogofilter/src/base64.c?view=patch&r1=6906&r2=6903

This affects bogofilter as shipped in Fedora 12 and 13, as well as EPEL5.

Heap-based buffer overflow in bogofilter and bogolexer 0.96.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via words that are longer than the input buffer used by flex.

Heap-based buffer overflow in bogofilter 0.96.2, 0.95.2, 0.94.14, 0.94.12, and other versions from 0.93.5 to 0.96.2, when using Unicode databases, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via "invalid input sequences" that lead to heap corruption when bogofilter or bogolexer converts character sets.

The quoted-printable decoder in bogofilter 0.17.4 to 0.92.7 allows remote attackers to cause a denial of service (application crash) via mail headers that cause a line feed (LF) to be replaced by a null byte that is written to an incorrect memory address.

bogopass in bogofilter 0.9.0.4 allows local users to overwrite arbitrary files via a symlink attack on the bogopass temporary file.