Date: Fri, 19 Nov 2004 13:40:25 -0500
From: security-advisories@freebsd.org
To: bugtraq@securityfocus.com
Subject: FreeBSD Security Advisory FreeBSD-SA-04:16.fetch
This is a multi-part message in MIME format.
------=_NextPart_1bf_3b39_00d5449f.b87606fa_.MIX
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D
FreeBSD-SA-04:16.fetch Security Adv=
isory
The FreeBSD Pr=
oject
Topic: Overflow error in fetch
Category: core
Module: fetch
Announced: 2004-11-18
Credits: Colin Percival
Affects: All FreeBSD versions.
Corrected: 2004-11-18 12:02:13 UTC (RELENG_5, 5.3-STABLE)
2004-11-18 12:03:05 UTC (RELENG_5_3, 5.3-RELEASE-p1)
2004-11-18 12:04:29 UTC (RELENG_5_2, 5.2.1-RELEASE-p12)
2004-11-18 12:05:36 UTC (RELENG_5_1, 5.1-RELEASE-p18)
2004-11-18 12:05:50 UTC (RELENG_5_0, 5.0-RELEASE-p22)
2004-11-18 12:02:29 UTC (RELENG_4, 4.10-STABLE)
2004-11-18 12:06:06 UTC (RELENG_4_10, 4.10-RELEASE-p4)
2004-11-18 12:06:22 UTC (RELENG_4_9, 4.9-RELEASE-p13)
2004-11-18 12:06:36 UTC (RELENG_4_8, 4.8-RELEASE-p26)
2004-11-18 12:06:52 UTC (RELENG_4_7, 4.7-RELEASE-p28)
FreeBSD only: YES
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit
<URL:http://www.freebsd.org/security/>;.
I. Background
The fetch(1) utility is a tool for fetching files via FTP, HTTP, and HTT=
PS.
II. Problem Description
An integer overflow condition in the processing of HTTP headers can resu=
lt
in a buffer overflow.
III. Impact
A malicious server or CGI script can respond to an HTTP or HTTPS request=
in
such a manner as to cause arbitrary portions of the client's memory to b=
e
overwritten, allowing for arbitrary code execution.
IV. Workaround
There is no known workaround for the affected application, although
the ftp(1) application in the FreeBSD base system, and several=20
applications in the FreeBSD Ports collection provide similar=20
functionality and could be used in place of fetch(1).
V. Solution
Perform one of the following:
1) Upgrade your vulnerable system to 4-STABLE or 5-STABLE, or to the
RELENG_5_3, RELENG_5_2, RELENG_4_10, or RELENG_4_8 security branch dated
after the correction date.
2) To patch your present system:
The following patches have been verified to apply to FreeBSD 4.8, 4.10,
5.2, and 5.3 systems.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
# ftp ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:16/fetch.patc=
h
# ftp ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:16/fetch.patc=
h.asc
b) Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
# cd /usr/src/usr.bin/fetch
# make obj && make depend && make && make install
3) IMPORTANT NOTE to users of FreeBSD Update:
FreeBSD Update (security/freebsd-update in the FreeBSD Ports collection)
is a binary security update system for the FreeBSD base system. It is=20
not supported or endorsed by the FreeBSD Security team, but its author
has requested that the following note be included in this advisory:
FreeBSD Update uses the fetch(1) utility for downloading security
updates to the FreeBSD base system. While these updates are=20
cryptographically signed, and FreeBSD Update is therefore immune from
most attacks, it is exposed to this vulnerability since the files
must be fetched before their integrity can be verified.
As a workaround, FreeBSD Update can be made to use the ftp(1) utility
for downloading updates as follows:
# sed -i.bak -e 's/fetch -qo/ftp -o/' /usr/local/sbin/freebsd-update
# freebsd-update fetch
# mv /usr/local/sbin/freebsd-update.bak /usr/local/sbin/freebsd-update
# freebsd-update install
VI. Correction details
The following list contains the revision numbers of each file that was
corrected in FreeBSD.
Branch Revisio=
n
Path
- ----------------------------------------------------------------------=
---
RELENG_4
src/usr.bin/fetch/fetch.c 1.10.2.2=
8
RELENG_4_10
src/UPDATING 1.73.2.90.2.=
5
src/sys/conf/newvers.sh 1.44.2.34.2.=
6
src/usr.bin/fetch/fetch.c 1.10.2.23.2.=
1
RELENG_4_9
src/UPDATING 1.73.2.89.2.1=
4
src/sys/conf/newvers.sh 1.44.2.32.2.1=
4
src/usr.bin/fetch/fetch.c 1.10.2.21.2.=
1
RELENG_4_8
src/UPDATING 1.73.2.80.2.2=
9
src/sys/conf/newvers.sh 1.44.2.29.2.2=
7
src/usr.bin/fetch/fetch.c 1.10.2.20.2.=
1
RELENG_4_7
src/UPDATING 1.73.2.74.2.3=
2
src/sys/conf/newvers.sh 1.44.2.26.2.3=
0
src/usr.bin/fetch/fetch.c 1.10.2.18.2.=
1
RELENG_5
src/usr.bin/fetch/fetch.c 1.72.2.=
2
RELENG_5_3
src/UPDATING 1.342.2.13.2.=
4
src/sys/conf/newvers.sh 1.62.2.15.2.=
6
src/usr.bin/fetch/fetch.c 1.72.2.1.2.=
1
RELENG_5_2
src/UPDATING 1.282.2.2=
0
src/sys/conf/newvers.sh 1.56.2.1=
9
src/usr.bin/fetch/fetch.c 1.62.4.=
1
RELENG_5_1
src/UPDATING 1.251.2.2=
0
src/sys/conf/newvers.sh 1.50.2.2=
0
src/usr.bin/fetch/fetch.c 1.62.2.=
1
RELENG_5_0
src/UPDATING 1.229.2.2=
8
src/sys/conf/newvers.sh 1.48.2.2=
3
src/usr.bin/fetch/fetch.c 1.58.2.=
1
- ----------------------------------------------------------------------=
---
VII. References
<other info on vulnerability>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (FreeBSD)
iD8DBQFBnJIEFdaIBMps37IRAm1/AKCISgScX7iQV6689Mm0jVk15pa0EgCgj1Pj
WSxoiyw5dAEC6PcSpMSIgZQ=3D
=3DIkr3
-----END PGP SIGNATURE-----
------=_NextPart_1bf_3b39_00d5449f.b87606fa_.MIX
Content-Type: application/octet-stream;
name="2#Mime.822"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="2#Mime.822"
UmV0dXJuLXBhdGg6IDxidWd0cmFxLXJldHVybi0xNjg3OC1kZnVycj1ld2EuY29tQHNlY3Vy
aXR5Zm9jdXMuY29tPg0KUmVjZWl2ZWQ6IGZyb20gb3V0Z29pbmcyLnNlY3VyaXR5Zm9jdXMu
Y29tDQoJKG91dGdvaW5nLnNlY3VyaXR5Zm9jdXMuY29tIFsyMDUuMjA2LjIzMS4yNl0pDQoJ
YnkgbWFpbDIuZXdhLmNvbTsgVGh1LCAxOCBOb3YgMjAwNCAxMToyNzoyNiAtMDUwMA0KUmVj
ZWl2ZWQ6IGZyb20gbGlzdHMyLnNlY3VyaXR5Zm9jdXMuY29tIChsaXN0czIuc2VjdXJpdHlm
b2N1cy5jb20gWzIwNS4yMDYuMjMxLjIwXSkNCglieSBvdXRnb2luZzIuc2VjdXJpdHlmb2N1
cy5jb20gKFBvc3RmaXgpIHdpdGggUU1RUA0KCWlkIDQ2NDVDMTQzNzFGOyBUaHUsIDE4IE5v
diAyMDA0IDA4OjI5OjA1IC0wNzAwIChNU1QpDQpNYWlsaW5nLUxpc3Q6IGNvbnRhY3QgYnVn
dHJhcS1oZWxwQHNlY3VyaXR5Zm9jdXMuY29tOyBydW4gYnkgZXptbG0NClByZWNlZGVuY2U6
IGJ1bGsNCkxpc3QtSWQ6IDxidWd0cmFxLmxpc3QtaWQuc2VjdXJpdHlmb2N1cy5jb20+DQpM
aXN0LVBvc3Q6IDxtYWlsdG86YnVndHJhcUBzZWN1cml0eWZvY3VzLmNvbT4NCkxpc3QtSGVs
cDogPG1haWx0bzpidWd0cmFxLWhlbHBAc2VjdXJpdHlmb2N1cy5jb20+DQpMaXN0LVVuc3Vi
c2NyaWJlOiA8bWFpbHRvOmJ1Z3RyYXEtdW5zdWJzY3JpYmVAc2VjdXJpdHlmb2N1cy5jb20+
DQpMaXN0LVN1YnNjcmliZTogPG1haWx0bzpidWd0cmFxLXN1YnNjcmliZUBzZWN1cml0eWZv
Y3VzLmNvbT4NCkRlbGl2ZXJlZC1UbzogbWFpbGluZyBsaXN0IGJ1Z3RyYXFAc2VjdXJpdHlm
b2N1cy5jb20NCkRlbGl2ZXJlZC1UbzogbW9kZXJhdG9yIGZvciBidWd0cmFxQHNlY3VyaXR5
Zm9jdXMuY29tDQpSZWNlaXZlZDogKHFtYWlsIDE0OTcgaW52b2tlZCBmcm9tIG5ldHdvcmsp
OyAxOCBOb3YgMjAwNCAwNjowNTozMyAtMDAwMA0KRnJvbTogRnJlZUJTRCBTZWN1cml0eSBB
ZHZpc29yaWVzIDxzZWN1cml0eS1hZHZpc29yaWVzQGZyZWVic2Qub3JnPg0KVG86IEJ1Z3Ry
YXEgPGJ1Z3RyYXFAc2VjdXJpdHlmb2N1cy5jb20+DQpTdWJqZWN0OiBGcmVlQlNEIFNlY3Vy
aXR5IEFkdmlzb3J5IEZyZWVCU0QtU0EtMDQ6MTYuZmV0Y2gNClJlcGx5LVRvOiBzZWN1cml0
eS1hZHZpc29yaWVzQGZyZWVic2Qub3JnDQpNZXNzYWdlLUlkOiA8MjAwNDExMTgxMjIyNTMu
MUFFMTBCODczQGR3cC5kZXMubm8+DQpEYXRlOiBUaHUsIDE4IE5vdiAyMDA0IDEzOjIyOjUz
ICswMTAwIChDRVQpDQpYLVNwYW0tQ2hlY2tlci1WZXJzaW9uOiBTcGFtQXNzYXNzaW4gMi42
NCAoMjAwNC0wMS0xMSkgb24gZmxvb2QuZGVzLm5vDQpYLVNwYW0tTGV2ZWw6IHMNClgtU3Bh
bS1TdGF0dXM6IE5vLCBoaXRzPTEuOCByZXF1aXJlZD01LjAgdGVzdHM9QUREUl9GUkVFIGF1
dG9sZWFybj1ubyANCgl2ZXJzaW9uPTIuNjQNCg0KLS0tLS1CRUdJTiBQR1AgU0lHTkVEIE1F
U1NBR0UtLS0tLQ0KSGFzaDogU0hBMQ0KDQo9PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQ0KRnJl
ZUJTRC1TQS0wNDoxNi5mZXRjaCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgU2VjdXJpdHkgQWR2aXNvcnkNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICBUaGUgRnJlZUJTRCBQcm9qZWN0DQoNClRvcGlj
OiAgICAgICAgICBPdmVyZmxvdyBlcnJvciBpbiBmZXRjaA0KDQpDYXRlZ29yeTogICAgICAg
Y29yZQ0KTW9kdWxlOiAgICAgICAgIGZldGNoDQpBbm5vdW5jZWQ6ICAgICAgMjAwNC0xMS0x
OA0KQ3JlZGl0czogICAgICAgIENvbGluIFBlcmNpdmFsDQpBZmZlY3RzOiAgICAgICAgQWxs
IEZyZWVCU0QgdmVyc2lvbnMuDQpDb3JyZWN0ZWQ6ICAgICAgMjAwNC0xMS0xOCAxMjowMjox
MyBVVEMgKFJFTEVOR181LCA1LjMtU1RBQkxFKQ0KICAgICAgICAgICAgICAgIDIwMDQtMTEt
MTggMTI6MDM6MDUgVVRDIChSRUxFTkdfNV8zLCA1LjMtUkVMRUFTRS1wMSkNCiAgICAgICAg
ICAgICAgICAyMDA0LTExLTE4IDEyOjA0OjI5IFVUQyAoUkVMRU5HXzVfMiwgNS4yLjEtUkVM
RUFTRS1wMTIpDQogICAgICAgICAgICAgICAgMjAwNC0xMS0xOCAxMjowNTozNiBVVEMgKFJF
TEVOR181XzEsIDUuMS1SRUxFQVNFLXAxOCkNCiAgICAgICAgICAgICAgICAyMDA0LTExLTE4
IDEyOjA1OjUwIFVUQyAoUkVMRU5HXzVfMCwgNS4wLVJFTEVBU0UtcDIyKQ0KICAgICAgICAg
ICAgICAgIDIwMDQtMTEtMTggMTI6MDI6MjkgVVRDIChSRUxFTkdfNCwgNC4xMC1TVEFCTEUp
DQogICAgICAgICAgICAgICAgMjAwNC0xMS0xOCAxMjowNjowNiBVVEMgKFJFTEVOR180XzEw
LCA0LjEwLVJFTEVBU0UtcDQpDQogICAgICAgICAgICAgICAgMjAwNC0xMS0xOCAxMjowNjoy
MiBVVEMgKFJFTEVOR180XzksIDQuOS1SRUxFQVNFLXAxMykNCiAgICAgICAgICAgICAgICAy
MDA0LTExLTE4IDEyOjA2OjM2IFVUQyAoUkVMRU5HXzRfOCwgNC44LVJFTEVBU0UtcDI2KQ0K
ICAgICAgICAgICAgICAgIDIwMDQtMTEtMTggMTI6MDY6NTIgVVRDIChSRUxFTkdfNF83LCA0
LjctUkVMRUFTRS1wMjgpDQpGcmVlQlNEIG9ubHk6ICAgWUVTDQoNCkZvciBnZW5lcmFsIGlu
Zm9ybWF0aW9uIHJlZ2FyZGluZyBGcmVlQlNEIFNlY3VyaXR5IEFkdmlzb3JpZXMsDQppbmNs
dWRpbmcgZGVzY3JpcHRpb25zIG9mIHRoZSBmaWVsZHMgYWJvdmUsIHNlY3VyaXR5IGJyYW5j
aGVzLCBhbmQgdGhlDQpmb2xsb3dpbmcgc2VjdGlvbnMsIHBsZWFzZSB2aXNpdA0KPFVSTDpo
dHRwOi8vd3d3LmZyZWVic2Qub3JnL3NlY3VyaXR5Lz4uDQoNCkkuICAgQmFja2dyb3VuZA0K
DQpUaGUgZmV0Y2goMSkgdXRpbGl0eSBpcyBhIHRvb2wgZm9yIGZldGNoaW5nIGZpbGVzIHZp
YSBGVFAsIEhUVFAsIGFuZCBIVFRQUy4NCg0KSUkuICBQcm9ibGVtIERlc2NyaXB0aW9uDQoN
CkFuIGludGVnZXIgb3ZlcmZsb3cgY29uZGl0aW9uIGluIHRoZSBwcm9jZXNzaW5nIG9mIEhU
VFAgaGVhZGVycyBjYW4gcmVzdWx0DQppbiBhIGJ1ZmZlciBvdmVyZmxvdy4NCg0KSUlJLiBJ
bXBhY3QNCg0KQSBtYWxpY2lvdXMgc2VydmVyIG9yIENHSSBzY3JpcHQgY2FuIHJlc3BvbmQg
dG8gYW4gSFRUUCBvciBIVFRQUyByZXF1ZXN0IGluDQpzdWNoIGEgbWFubmVyIGFzIHRvIGNh
dXNlIGFyYml0cmFyeSBwb3J0aW9ucyBvZiB0aGUgY2xpZW50J3MgbWVtb3J5IHRvIGJlDQpv
dmVyd3JpdHRlbiwgYWxsb3dpbmcgZm9yIGFyYml0cmFyeSBjb2RlIGV4ZWN1dGlvbi4NCg0K
SVYuICBXb3JrYXJvdW5kDQoNClRoZXJlIGlzIG5vIGtub3duIHdvcmthcm91bmQgZm9yIHRo
ZSBhZmZlY3RlZCBhcHBsaWNhdGlvbiwgYWx0aG91Z2gNCnRoZSBmdHAoMSkgYXBwbGljYXRp
b24gaW4gdGhlIEZyZWVCU0QgYmFzZSBzeXN0ZW0sIGFuZCBzZXZlcmFsIA0KYXBwbGljYXRp
b25zIGluIHRoZSBGcmVlQlNEIFBvcnRzIGNvbGxlY3Rpb24gcHJvdmlkZSBzaW1pbGFyIA0K
ZnVuY3Rpb25hbGl0eSBhbmQgY291bGQgYmUgdXNlZCBpbiBwbGFjZSBvZiBmZXRjaCgxKS4N
Cg0KVi4gICBTb2x1dGlvbg0KDQpQZXJmb3JtIG9uZSBvZiB0aGUgZm9sbG93aW5nOg0KDQox
KSBVcGdyYWRlIHlvdXIgdnVsbmVyYWJsZSBzeXN0ZW0gdG8gNC1TVEFCTEUgb3IgNS1TVEFC
TEUsIG9yIHRvIHRoZQ0KUkVMRU5HXzVfMywgUkVMRU5HXzVfMiwgUkVMRU5HXzRfMTAsIG9y
IFJFTEVOR180Xzggc2VjdXJpdHkgYnJhbmNoIGRhdGVkDQphZnRlciB0aGUgY29ycmVjdGlv
biBkYXRlLg0KDQoyKSBUbyBwYXRjaCB5b3VyIHByZXNlbnQgc3lzdGVtOg0KDQpUaGUgZm9s
bG93aW5nIHBhdGNoZXMgaGF2ZSBiZWVuIHZlcmlmaWVkIHRvIGFwcGx5IHRvIEZyZWVCU0Qg
NC44LCA0LjEwLA0KNS4yLCBhbmQgNS4zIHN5c3RlbXMuDQoNCmEpIERvd25sb2FkIHRoZSBy
ZWxldmFudCBwYXRjaCBmcm9tIHRoZSBsb2NhdGlvbiBiZWxvdywgYW5kIHZlcmlmeSB0aGUN
CmRldGFjaGVkIFBHUCBzaWduYXR1cmUgdXNpbmcgeW91ciBQR1AgdXRpbGl0eS4NCg0KIyBm
dHAgZnRwOi8vZnRwLkZyZWVCU0Qub3JnL3B1Yi9GcmVlQlNEL0NFUlQvcGF0Y2hlcy9TQS0w
NDoxNi9mZXRjaC5wYXRjaA0KIyBmdHAgZnRwOi8vZnRwLkZyZWVCU0Qub3JnL3B1Yi9GcmVl
QlNEL0NFUlQvcGF0Y2hlcy9TQS0wNDoxNi9mZXRjaC5wYXRjaC5hc2MNCg0KYikgRXhlY3V0
ZSB0aGUgZm9sbG93aW5nIGNvbW1hbmRzIGFzIHJvb3Q6DQoNCiMgY2QgL3Vzci9zcmMNCiMg
cGF0Y2ggPCAvcGF0aC90by9wYXRjaA0KIyBjZCAvdXNyL3NyYy91c3IuYmluL2ZldGNoDQoj
IG1ha2Ugb2JqICYmIG1ha2UgZGVwZW5kICYmIG1ha2UgJiYgbWFrZSBpbnN0YWxsDQoNCjMp
IElNUE9SVEFOVCBOT1RFIHRvIHVzZXJzIG9mIEZyZWVCU0QgVXBkYXRlOg0KDQpGcmVlQlNE
IFVwZGF0ZSAoc2VjdXJpdHkvZnJlZWJzZC11cGRhdGUgaW4gdGhlIEZyZWVCU0QgUG9ydHMg
Y29sbGVjdGlvbikNCmlzIGEgYmluYXJ5IHNlY3VyaXR5IHVwZGF0ZSBzeXN0ZW0gZm9yIHRo
ZSBGcmVlQlNEIGJhc2Ugc3lzdGVtLiAgSXQgaXMgDQpub3Qgc3VwcG9ydGVkIG9yIGVuZG9y
c2VkIGJ5IHRoZSBGcmVlQlNEIFNlY3VyaXR5IHRlYW0sIGJ1dCBpdHMgYXV0aG9yDQpoYXMg
cmVxdWVzdGVkIHRoYXQgdGhlIGZvbGxvd2luZyBub3RlIGJlIGluY2x1ZGVkIGluIHRoaXMg
YWR2aXNvcnk6DQoNCiAgRnJlZUJTRCBVcGRhdGUgdXNlcyB0aGUgZmV0Y2goMSkgdXRpbGl0
eSBmb3IgZG93bmxvYWRpbmcgc2VjdXJpdHkNCiAgdXBkYXRlcyB0byB0aGUgRnJlZUJTRCBi
YXNlIHN5c3RlbS4gIFdoaWxlIHRoZXNlIHVwZGF0ZXMgYXJlIA0KICBjcnlwdG9ncmFwaGlj
YWxseSBzaWduZWQsIGFuZCBGcmVlQlNEIFVwZGF0ZSBpcyB0aGVyZWZvcmUgaW1tdW5lIGZy
b20NCiAgbW9zdCBhdHRhY2tzLCBpdCBpcyBleHBvc2VkIHRvIHRoaXMgdnVsbmVyYWJpbGl0
eSBzaW5jZSB0aGUgZmlsZXMNCiAgbXVzdCBiZSBmZXRjaGVkIGJlZm9yZSB0aGVpciBpbnRl
Z3JpdHkgY2FuIGJlIHZlcmlmaWVkLg0KDQogIEFzIGEgd29ya2Fyb3VuZCwgRnJlZUJTRCBV
cGRhdGUgY2FuIGJlIG1hZGUgdG8gdXNlIHRoZSBmdHAoMSkgdXRpbGl0eQ0KICBmb3IgZG93
bmxvYWRpbmcgdXBkYXRlcyBhcyBmb2xsb3dzOg0KDQogICMgc2VkIC1pLmJhayAtZSAncy9m
ZXRjaCAtcW8vZnRwIC1vLycgL3Vzci9sb2NhbC9zYmluL2ZyZWVic2QtdXBkYXRlDQogICMg
ZnJlZWJzZC11cGRhdGUgZmV0Y2gNCiAgIyBtdiAvdXNyL2xvY2FsL3NiaW4vZnJlZWJzZC11
cGRhdGUuYmFrIC91c3IvbG9jYWwvc2Jpbi9mcmVlYnNkLXVwZGF0ZQ0KICAjIGZyZWVic2Qt
dXBkYXRlIGluc3RhbGwNCg0KVkkuICBDb3JyZWN0aW9uIGRldGFpbHMNCg0KVGhlIGZvbGxv
d2luZyBsaXN0IGNvbnRhaW5zIHRoZSByZXZpc2lvbiBudW1iZXJzIG9mIGVhY2ggZmlsZSB0
aGF0IHdhcw0KY29ycmVjdGVkIGluIEZyZWVCU0QuDQoNCkJyYW5jaCAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUmV2aXNpb24N
CiAgUGF0aA0KLSAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQpSRUxFTkdfNA0KICBzcmMvdXNyLmJp
bi9mZXRjaC9mZXRjaC5jICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDEu
MTAuMi4yOA0KUkVMRU5HXzRfMTANCiAgc3JjL1VQREFUSU5HICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgIDEuNzMuMi45MC4yLjUNCiAgc3JjL3N5cy9j
b25mL25ld3ZlcnMuc2ggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDEuNDQu
Mi4zNC4yLjYNCiAgc3JjL3Vzci5iaW4vZmV0Y2gvZmV0Y2guYyAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgIDEuMTAuMi4yMy4yLjENClJFTEVOR180XzkNCiAgc3JjL1VQREFU
SU5HICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgMS43My4y
Ljg5LjIuMTQNCiAgc3JjL3N5cy9jb25mL25ld3ZlcnMuc2ggICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgMS40NC4yLjMyLjIuMTQNCiAgc3JjL3Vzci5iaW4vZmV0Y2gvZmV0
Y2guYyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDEuMTAuMi4yMS4yLjENClJF
TEVOR180XzgNCiAgc3JjL1VQREFUSU5HICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgMS43My4yLjgwLjIuMjkNCiAgc3JjL3N5cy9jb25mL25ld3ZlcnMu
c2ggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgMS40NC4yLjI5LjIuMjcNCiAg
c3JjL3Vzci5iaW4vZmV0Y2gvZmV0Y2guYyAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgIDEuMTAuMi4yMC4yLjENClJFTEVOR180XzcNCiAgc3JjL1VQREFUSU5HICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgMS43My4yLjc0LjIuMzINCiAg
c3JjL3N5cy9jb25mL25ld3ZlcnMuc2ggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgMS40NC4yLjI2LjIuMzANCiAgc3JjL3Vzci5iaW4vZmV0Y2gvZmV0Y2guYyAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIDEuMTAuMi4xOC4yLjENClJFTEVOR181DQogIHNy
Yy91c3IuYmluL2ZldGNoL2ZldGNoLmMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgIDEuNzIuMi4yDQpSRUxFTkdfNV8zDQogIHNyYy9VUERBVElORyAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDEuMzQyLjIuMTMuMi40DQogIHNy
Yy9zeXMvY29uZi9uZXd2ZXJzLnNoICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAxLjYyLjIuMTUuMi42DQogIHNyYy91c3IuYmluL2ZldGNoL2ZldGNoLmMgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgMS43Mi4yLjEuMi4xDQpSRUxFTkdfNV8yDQogIHNy
Yy9VUERBVElORyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAxLjI4Mi4yLjIwDQogIHNyYy9zeXMvY29uZi9uZXd2ZXJzLnNoICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgMS41Ni4yLjE5DQogIHNyYy91c3IuYmluL2Zl
dGNoL2ZldGNoLmMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDEuNjIu
NC4xDQpSRUxFTkdfNV8xDQogIHNyYy9VUERBVElORyAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAxLjI1MS4yLjIwDQogIHNyYy9zeXMvY29uZi9u
ZXd2ZXJzLnNoICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgMS41MC4y
LjIwDQogIHNyYy91c3IuYmluL2ZldGNoL2ZldGNoLmMgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgIDEuNjIuMi4xDQpSRUxFTkdfNV8wDQogIHNyYy9VUERBVElORyAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAxLjIyOS4y
LjI4DQogIHNyYy9zeXMvY29uZi9uZXd2ZXJzLnNoICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgMS40OC4yLjIzDQogIHNyYy91c3IuYmluL2ZldGNoL2ZldGNoLmMg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDEuNTguMi4xDQotIC0tLS0t
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
LS0tLS0tLS0tLS0tLS0NCg0KVklJLiBSZWZlcmVuY2VzDQoNCjxvdGhlciBpbmZvIG9uIHZ1
bG5lcmFiaWxpdHk+DQotLS0tLUJFR0lOIFBHUCBTSUdOQVRVUkUtLS0tLQ0KVmVyc2lvbjog
R251UEcgdjEuMi42IChGcmVlQlNEKQ0KDQppRDhEQlFGQm5KSUVGZGFJQk1wczM3SVJBbTEv
QUtDSVNnU2NYN2lRVjY2ODlNbTBqVmsxNXBhMEVnQ2dqMVBqDQpXU3hvaXl3NWRBRUM2UGNT
cE1TSWdaUT0NCj1Ja3IzDQotLS0tLUVORCBQR1AgU0lHTkFUVVJFLS0tLS0NCg==
------=_NextPart_1bf_3b39_00d5449f.b87606fa_.MIX
Content-Type: text/plain;
name="GWAVADAT.TXT"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: attachment; filename="GWAVADAT.TXT"
AdmID:280C87F0DD62EEACED9465801C29FBE9
------=_NextPart_1bf_3b39_00d5449f.b87606fa_.MIX--
