Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 524
Alerts This Week
Warning Icon 1 524

Severe Buffer Overflow Vulnerability in Procmail for RHEL 7 Systems

red hat
Calendar Grey November 28, 2017
Scroller Redhat
Keep informed about the latest Red Hat notification concerning the procmail security patch that addresses a significant buffer overflow vulnerability.
An update for procmail is now available for Red Hat Enterprise Linux 7

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Summary

The procmail packages contain a mail processing tool that can be used to create mail servers, mailing lists, sort incoming mail into separate folders or files, preprocess mail, start any program upon mail arrival, or automatically forward selected incoming mail.
Security Fix(es):
* A heap-based buffer overflow flaw was found in procmail's formail utility. A remote attacker could send a specially crafted email that, when processed by formail, could cause formail to crash or, possibly, execute arbitrary code as the user running formail. (CVE-2017-16844)

Topics%20covered

Topics Covered

security advisory buffer overflow security fix important Red Hat Enterprise procmail email processing

References

https://access.redhat.com/security/cve/CVE-2017-16844 https://access.redhat.com/security/updates/classification/#important

Package List

Red Hat Enterprise Linux Client Optional (v. 7):
Source: procmail-3.22-36.el7_4.1.src.rpm
x86_64: procmail-3.22-36.el7_4.1.x86_64.rpm procmail-debuginfo-3.22-36.el7_4.1.x86_64.rpm
Red Hat Enterprise Linux Server (v. 7):
Source: procmail-3.22-36.el7_4.1.src.rpm
ppc64: procmail-3.22-36.el7_4.1.ppc64.rpm procmail-debuginfo-3.22-36.el7_4.1.ppc64.rpm
ppc64le: procmail-3.22-36.el7_4.1.ppc64le.rpm procmail-debuginfo-3.22-36.el7_4.1.ppc64le.rpm
s390x: procmail-3.22-36.el7_4.1.s390x.rpm procmail-debuginfo-3.22-36.el7_4.1.s390x.rpm
x86_64: procmail-3.22-36.el7_4.1.x86_64.rpm procmail-debuginfo-3.22-36.el7_4.1.x86_64.rpm
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7):
Source: procmail-3.22-36.el7_4.1.src.rpm
aarch64: procmail-3.22-36.el7_4.1.aarch64.rpm procmail-debuginfo-3.22-36.el7_4.1.aarch64.rpm
ppc64le: procmail-3.22-36.el7_4.1.ppc64le.rpm procmail-debuginfo-3.22-36.el7_4.1.ppc64le.rpm
Red Hat Enterprise Linux Workstation (v. 7):
Source: procmail-3.22-36.el7_4.1.src.rpm
x86_64: procmail-3.22-36.el7_4.1.x86_64.rpm procmail-debuginfo-3.22-36.el7_4.1.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/


Severity
important
Lowest
Low
Medium
High
Critical

Advisory ID: RHSA-2017:3269-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2017:3269
Issue date: 2017-11-28

Topic

An update for procmail is now available for Red Hat Enterprise Linux 7.Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory buffer overflow security fix important Red Hat Enterprise procmail email processing

Relevant Releases Architectures

Red Hat Enterprise Linux Client Optional (v. 7) - x86_64

Red Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64

Red Hat Enterprise Linux Workstation (v. 7) - x86_64

Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) - aarch64, ppc64le

Bugs Fixed

1500070 - CVE-2017-16844 procmail: Heap-based buffer overflow in loadbuf function in formisc.c

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.