CERT® Advisory CA-1998-08 Buffer overflows in some POP serversOriginal issue date: July 14, 1998
Last revised: August 24, 1998
Added vendor information for Silicon Graphics Inc.
A complete revision history is at the end of this file.
The CERT Coordination Center has received reports of buffer overflows in some Post Office Protocol (POP) servers. For a list of vulnerable versions and platforms, please refer to Appendix A. For help in determining which version you are currently running, see Section III.A below.
The CERT/CC team recommends that anyone running a vulnerable version of this software upgrade to the current vendor-recommended version. Until you can do so, we suggest disabling the POP server.
We will update this advisory as we receive additional information. Please check our advisory files regularly for updates that relate to your site.
The CERT Coordination Center has received reports of buffer overflow vulnerabilities in some POP servers based on QUALCOMM's qpopper. Qpopper is a Post Office Protocol (POP) server used for downloading Internet e-mail.
Information about this vulnerability has been posted to various mailing lists and newsgroups, and the CERT Coordination Center has received reports of incidents in which this vulnerability has been exploited to gain privileged access.
Remote users can gain privileged (root) access to systems running vulnerable versions of POP servers.
If you determine that your POP server is vulnerable (Sec. A), install a patch from your vendor. Until you can do so, we urge you to disable the POP server.
Appendix A - Vendor Information
Below is a list of the vendors who have provided information for this advisory. We will update this appendix as we receive additional information. If you do not see your vendor's name, the CERT/CC did not hear from that vendor. Please contact the vendor directly.
Data General does not ship qpopper, or any other POP client or server.
Digital Equipment Corporation
Copyright 1994, 1995, 1996, 1997 Compaq Computer Corporation. All rights reserved. SOURCE: Compaq Computer Corporation Compaq's Digital UNIX / ULTRIX Software Security Response Team USA This reported problem is not present for the as shipped, Compaq's Digital ULTRIX or Compaq's Digital UNIX Operating Systems Software.
Fujitsu's UXP/V operating system does not support qpopper so we are not affected by it.
OpenBSD does not ship qpopper.
Versions of QUALCOMM qpopper prior to 2.5 are vulnerable. QUALCOMM recommends upgrading to the most recent version (currently Version 2.52). Patches are available from ftp://ftp.qualcomm.com/Eudora/servers/unix/popper Further details, questions and comments should be sent to firstname.lastname@example.org.
Santa Cruz Operation, Inc.
The following releases of SCO Operating Systems contain a version of the Qualcomm popper that is vulnerable: - - SCO OpenServer Releases 5.0.0, 5.0.2, 5.0.4 - - SCO Internet FastStart Releases 1.0, 1.1 The following SCO Operating Systems are not vulnerable, - - SCO UnixWare 7 - - SCO UnixWare 2.1 - - SCO CMW+ - - SCO Open Desktop / Open Server 3.0, SCO UNIX 3.2v4 Binary versions of the patched popper will be available shortly from the SCO ftp site: ftp://ftp.sco.com/SSE/sse013.ltr - cover letter ftp://ftp.sco.com/SSE/sse013.tar.Z - replacement binary The fix includes binaries for the following SCO operating systems: - - SCO OpenServer 5.0.0, 5.0.2, 5.0.4 - - SCO Internet FastStart Releases 1.0, 1.1 For the latest security bulletins and patches for SCO products, please refer to http://www.sco.com/security/ .
Silicon Graphics Inc.
Please refer to Silicon Graphics Inc. Security Advisory, "BSD/Qualcomm qpopper Vulnerability," Number: 19980801-01-I, distributed August 6, 1998 for additional information relating to this vulnerability.
The primary SGI anonymous FTP site for security information and patches is sgigate.sgi.com (220.127.116.11). Security information and patches are located under the directories ~ftp/security and ~ftp/patches, respectively. The Silicon Graphics Security Headquarters Web page is accessible at the URL http://www.sgi.com/Support/security/security.html.
The CERT Coordination Center thanks Travis Mikalson at TerraNovaNet, Inc., for reporting the vulnerability, and Laurence Lundblade at QUALCOMM Incorporated for providing technical details and support in the development of the advisory. We also acknowledge other members of the Internet community who posted about this problem.
This document is available from: http://www.cert.org/advisories/CA-1998-08.html
CERT/CC Contact Information
Phone: +1 412-268-7090 (24-hour hotline)
Fax: +1 412-268-6989
CERT/CC personnel answer the hotline 08:00-17:00 EST(GMT-5) / EDT(GMT-4) Monday through Friday; they are on call for emergencies during other hours, on U.S. holidays, and on weekends.
We strongly urge you to encrypt sensitive information sent by email. Our public PGP key is available from
If you prefer to use DES, please call the CERT hotline for more information.
Getting security information
CERT publications and other security information are available from our web site
* "CERT" and "CERT Coordination Center" are registered in the U.S. Patent and Trademark Office.
Conditions for use, disclaimers, and sponsorship information
Copyright 1998 Carnegie Mellon University.
Aug. 24, 1998 Added vendor information for Silicon Graphics Inc. July 22, 1998 Updated vendor information for Fujitsu and Santa Cruz Operation, Inc. July 14, 1998 Added vendor information for Digital Equipment Corporation.