GLSA Advocate
Joined: 12 May 2004 Posts: 2663
|
Posted: Thu Dec 15, 2005 5:42 am Post subject: [ GLSA 200512-05 ] Xmail: Privilege escalation through sendm |
|
|
Gentoo Linux Security Advisory
Title: Xmail: Privilege escalation through sendmail (GLSA 200512-05)
Severity: high
Exploitable: local
Date: December 14, 2005
Bug(s): #109381
ID: 200512-05
Synopsis
The sendmail program in Xmail is vulnerable to a buffer overflow,
potentially resulting in local privilege escalation.
Background
Xmail is an Internet and intranet mail server.
Affected Packages
Package: mail-mta/xmail
Vulnerable: < 1.22
Unaffected: >= 1.22
Architectures: All supported architectures
Description
iDEFENSE reported that the AddressFromAtPtr function in the
sendmail program fails to check bounds on arguments passed from other
functions, and as a result an exploitable stack overflow condition
occurs when specifying the "-t" command line option.
Impact
A local attacker can make a malicious call to sendmail,
potentially resulting in code execution with elevated privileges.
Workaround
There is no known workaround at this time.
Resolution
All Xmail users should upgrade to the latest version:
Code: | # emerge --sync
# emerge --ask --oneshot --verbose ">=mail-mta/xmail-1.22" |
References
CVE-2005-2943
iDEFENSE Security Advisory
Last edited by GLSA on Thu Aug 01, 2013 4:21 am; edited 7 times in total |
|