Dear Everyone,
In brief, Qualcomm's POP server is OK and doesn't contain the
security flaw.
Apparently only POP servers derived from the University of
Washington's ipop are vulnerable.
The current version of qpopper is 2.2 and it can be obtained
from
ftp://ftp.eudora.com/quest/unix/servers/popper/qpop2.2.tar.Z
(thanks to Woody Lee for this information).
Respondents:
Liz Stewart <liz_at_ece.neu.edu>
paw_at_northstar.dartmouth.edu
Woody Lee <woody_at_gergu3.gerg.tamu.edu>
benites_at_tryon.cs.unca.edu (Robert Benites)
"John P. Speno" <speno_at_swarthmore.edu>
Jacob Ring <jacob_at_uscolo.edu>
David Sacerdote <davids_at_secnet.com>
"Richard L Jackson Jr" <rjackson_at_portal.gmu.edu>
"P. Godwin" <pgodwin_at_phad.den.mmc.com>
ciac-bulletin_at_cheetah.llnl.gov Fri Apr 11 03:03 MDT 1997
crawford_at_eek.llnl.gov (David Crawford)
michele_at_garnet.berkeley.edu (Michele Tomkin)
Gordy Thompson <gordy_at_nytimes.com>
David Sacerdote <davids_at_secnet.com>
Steve VanDevender <stevev_at_hexadecimal.uoregon.edu>
Karen Byrd <BYRD_at_mscf.med.upenn.edu>
Thanks to all!
My original post:
Dear Managers,
The Qualcomm pop server has been mentioned in this list
several times. I'm running version 2.1.4 and I want to know if the
CERT advisory CA-97.09 (about a security flaw in POP and IMAP
software) applies. Does anyone know? Failing that, does anyone know
the definitive e-mail address to contact at Qualcomm (I sent a message
to an address I located on WhoWhere, but I have no idea if it's the
right one).
qpop doesn't current appear on Qualcomm's FTP server, which
apparently is being reorganized.
Larry
============================================================================
Larry Griffith Dept. of Computer & Info Science
larry_at_garfield.wsc.mass.edu Westfield State College
(413) 572-5294 Westfield, MA 01086 USA
PGP public key available at:
http://garfield.wsc.mass.edu/dcis/griffith.html
============================================================================
Received on Fri Apr 11 1997 - 20:00:20 NZST