Joined: 12 May 2004
|Posted: Fri May 27, 2005 11:44 am Post subject: [ GLSA 200505-20 ] Mailutils: Multiple vulnerabilities in im
|Gentoo Linux Security Advisory
Title: Mailutils: Multiple vulnerabilities in imap4d and mail (GLSA 200505-20)
Date: May 27, 2005
The imap4d server and the mail utility from GNU Mailutils contain multiple vulnerabilities, potentially allowing a remote attacker to execute arbitrary code with root privileges.
GNU Mailutils is a collection of mail-related utilities, including an IMAP4 server (imap4d) and a Mail User Agent (mail).
Vulnerable: < 0.6-r1
Unaffected: >= 0.6-r1
Architectures: All supported architectures
infamous41d discovered several vulnerabilities in GNU Mailutils. imap4d does not correctly implement formatted printing of command tags (CAN-2005-1523), fails to validate the range sequence of the "FETCH" command (CAN-2005-1522), and contains an integer overflow in the "fetch_io" routine (CAN-2005-1521). mail contains a buffer overflow in "header_get_field_name()" (CAN-2005-1520).
A remote attacker can exploit the format string and integer overflow in imap4d to execute arbitrary code as the imap4d user, which is usually root. By sending a specially crafted email message, a remote attacker could exploit the buffer overflow in the "mail" utility to execute arbitrary code with the rights of the user running mail. Finally, a remote attacker can also trigger a Denial of Service by sending a malicious FETCH command to an affected imap4d, causing excessive resource consumption.
There are no known workarounds at this time.
All GNU Mailutils users should upgrade to the latest available version:
|# emerge --sync
# emerge --ask --oneshot --verbose ">=net-mail/mailutils-0.6-r1"
iDEFENSE 05.25.05 advisories
Last edited by GLSA on Sun May 07, 2006 4:57 pm; edited 1 time in total