Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -7 articles for you...
91
security advisoryhigh severitygentooGentoo GLSA-200509-10 High: Mailutils Code Exec Risk for imap4d
The imap4d server contains a vulnerability allowing an authenticated user to execute arbitrary code with the privileges of the imap4d process. [More...]. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200509-10 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: Mailutils: Format string vulnerability in imap4d Date: September 17, 2005 Bugs: #105458 ID: 200509-10 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= The imap4d server contains a vulnerability allowing an authenticated user to execute arbitrary code with the privileges of the imap4d process. Background ========= The GNU Mailutils are a collection of mail-related utilities, including an IMAP4 server (imap4d). Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-mail/mailutils < 0.6-r2 > = 0.6-r2 Description ========== The imap4d server contains a format string bug in the handling of IMAP SEARCH requests. Impact ===== An authenticated IMAP user could exploit the format string error in imap4d to execute arbitrary code as the imap4d user, which is usually root. Workaround ========= There are no known workarounds at this time. Resolution ========= All GNU Mailutils users should upgrade to the latest available version: # emerge --sync # emerge --ask --oneshot --verbose "> =net-mail/mailutils-0.6-r2" References ========= [ 1 ] iDEFENSE 09.09.05 advisory ;type=vulnerabilities Availability =========== This GLSA and any updates to it are available for viewing at the GentooSecurity Website: https://security.gentoo.org/glsa/200509-10 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
Sep 17, 2005
Gentoo
91
security advisoryhigh severitygentooGentoo: GLSA 200505-20 High: Mailutils Remote Code Exploits
The imap4d server and the mail utility from GNU Mailutils contain multiple vulnerabilities, potentially allowing a remote attacker to execute arbitrary code with root privileges. [More...]. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200505-20 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: Mailutils: Multiple vulnerabilities in imap4d and mail Date: May 27, 2005 Bugs: #94053 ID: 200505-20 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= The imap4d server and the mail utility from GNU Mailutils contain multiple vulnerabilities, potentially allowing a remote attacker to execute arbitrary code with root privileges. Background ========= GNU Mailutils is a collection of mail-related utilities, including an IMAP4 server (imap4d) and a Mail User Agent (mail). Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-mail/mailutils < 0.6-r1 > = 0.6-r1 Description ========== infamous41d discovered several vulnerabilities in GNU Mailutils. imap4d does not correctly implement formatted printing of command tags (CAN-2005-1523), fails to validate the range sequence of the "FETCH" command (CAN-2005-1522), and contains an integer overflow in the "fetch_io" routine (CAN-2005-1521). mail contains a buffer overflow in "header_get_field_name()" (CAN-2005-1520). Impact ===== A remote attacker can exploit the format string and integer overflow in imap4d to execute arbitrary code as the imap4d user, which is usually root. By sending a specially crafted emailmessage, a remote attacker could exploit the buffer overflow in the "mail" utility to execute arbitrary code with the rights of the user running mail. Finally, a remote attacker can also trigger a Denial of Service by sending a malicious FETCH command to an affected imap4d, causing excessive resource consumption. Workaround ========= There are no known workarounds at this time. Resolution ========= All GNU Mailutils users should upgrade to the latest available version: # emerge --sync # emerge --ask --oneshot --verbose "> =net-mail/mailutils-0.6-r1" References ========= [ 1 ] CAN-2005-1520 [ 2 ] CAN-2005-1521 [ 3 ] CAN-2005-1522 [ 4 ] CAN-2005-1523 [ 5 ] iDEFENSE 05.25.05 advisories ;showYear=2005 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200505-20 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
May 27, 2005
Gentoo
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!