|
|
Info |
Last Modified |
| 6 months ago |
|
|
|
|
Description |
A remote overflow exists in the 'autorespond' utility included in the qmailadmin package. autorespond fails to perform boundary checks when copying environment variables set by the Mail Transfer Agent (MTA). With a specially crafted request, an attacker can cause a buffer overflow resulting in a loss of integrity and availability.
|
|
Classification |
Location:
Remote/Network Access Required
Attack Type:
Input Manipulation
Impact:
Loss of Integrity,
Loss of Availability
Exploit:
Exploit Unknown
Disclosure:
OSVDB Verified
|
|
Technical |
EXT and HOST environment variables could cause a buffer overflow in autorespond.c
This vulnerability could potentially be exploited by a remote attacker to gain the privileges of a user who has configured qmail to forward messages to autorespond.
autorespond usually comes as a part of the qmailadmin package, which is separate from the qmail mail server itself.
|
|
Solution |
Upgrade to version 2.0.4 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.
|
|
Products |
|
autorespond
 |
2.0.2-2 |
2.0.2-1 |
2.0.1-1 |
|
|
|
|
|
|
|
BlogsProvided by Technorati
|
None found at this time
|
|
|
