COMMAND
	Qpopper buffer overflow condition
SYSTEMS AFFECTED
	Qpopper 4.0.3 and 4.0.4. default install.
PROBLEM
	In Marcel Fodor [http://mantra.freeweb.hu] security bug report :
	In :
	
	pop_bull.c
	-----------
	int
	CopyOneBull ( POP *p, long bnum, char *name )
	{
	    FILE              *bull;
	    char                buffer [ MAXMSGLINELEN ];
	    BOOL            in_header            = TRUE;
	    BOOL            first_line              = TRUE;
	    int                    nchar; 
	    int                    msg_num;
	    int                    msg_vis_num          = 0;
	    int                    msg_ends_in_nl       = 0;
	    char                bullName [ 256 ];
	    MsgInfoList    *mp;               /* Pointer to message info list */
	.
	.
	.
	    sprintf ( bullName, "%s/%s", p->bulldir, name );
	------------
	
	The bullNmae buffer is 256 bytes long, but in the  user's  configuration
	file you can define it up to MAXLINELEN-1-sizeof("set  bulldir=")  ~1010
	bytes.
	
	~/.qpopper-options
	--------------
	set bulldir=AAAAAAAAAAA.....AAAAAAAAAAAAAAA // ( bulldir must exist)
	--------------
	
	Since we have only 1010+256 bytes(p->bulldir+name) it is NOT  enough  to
	overflow the funcion`s stack and overwrite EIP.
	As you see the following registers can be overwritten:
	
	    BOOL         in_header            = TRUE; 
	    BOOL         first_line              = TRUE; 
	    int                nchar; 
	    int                msg_num;
	    int                msg_vis_num       = 0;
	    int                msg_ends_in_nl   = 0;
	    char             bullName [ 256 ];
	---------------------
	    MsgInfoList   *mp;               /* Pointer to message info list */
	
	There are two valuable registers:
	
	    1. msg_num
	    2. msg_vis_num
	
	As the code runs on, server  wants  to  find  memory  location  for  the
	actual message. Here it is:
	
	   mp = p->mlp + msg_num - 1;
	
	As we have control over msg_num, we  can  walk  forward  in  memory,  by
	steps of 0x40 bytes (sizeof(*mp)). On my  system  giving  the  value  of
	0x2dfe423 to msg_num, mp will point to 0xbfffbe6c Now code runs on,  and
	fill up properties.
	 
	    ++mp;
	    mp->number          = msg_num;
	    mp->visible_num    = ++msg_vis_num;               <---- we have this
	    mp->lines               = 0;
	    mp->body_lines     = 0;
	    mp->offset             = ftell(p->drop);
	    mp->del_flag         = FALSE;
	    mp->hide_flag       = FALSE;
	    mp->retr_flag        = FALSE;
	
	So, the main thing is the 0x40 bytes steps. For this, the  risk  of  the
	bug is low.
SOLUTION
	 Workaround  :
	 ==========
	Servers, not processing user's configuration  file  (~/.qpopper-options)
	are insensible to this bug. ( qpopper -u)
	 Patch :
	 =====
	None yet ?