GLSA-200505-20 : Mailutils: Multiple vulnerabilities in imap4d and mail

This script is Copyright (C) 2005-2014 Tenable Network Security, Inc.


Synopsis :

The remote Gentoo host is missing one or more security-related
patches.

Description :

The remote host is affected by the vulnerability described in GLSA-200505-20
(Mailutils: Multiple vulnerabilities in imap4d and mail)

infamous41d discovered several vulnerabilities in GNU Mailutils.
imap4d does not correctly implement formatted printing of command tags
(CAN-2005-1523), fails to validate the range sequence of the 'FETCH'
command (CAN-2005-1522), and contains an integer overflow in the
'fetch_io' routine (CAN-2005-1521). mail contains a buffer overflow in
'header_get_field_name()' (CAN-2005-1520).

Impact :

A remote attacker can exploit the format string and integer
overflow in imap4d to execute arbitrary code as the imap4d user, which
is usually root. By sending a specially crafted email message, a remote
attacker could exploit the buffer overflow in the 'mail' utility to
execute arbitrary code with the rights of the user running mail.
Finally, a remote attacker can also trigger a Denial of Service by
sending a malicious FETCH command to an affected imap4d, causing
excessive resource consumption.

Workaround :

There are no known workarounds at this time.

See also :

http://www.nessus.org/u?25ab4cb8
http://www.nessus.org/u?d6033f90
http://www.nessus.org/u?ceebb2fd
http://www.nessus.org/u?f7b7be14
http://www.gentoo.org/security/en/glsa/glsa-200505-20.xml

Solution :

All GNU Mailutils users should upgrade to the latest available
version:
# emerge --sync
# emerge --ask --oneshot --verbose '>=net-mail/mailutils-0.6-r1'

Risk factor :

High / CVSS Base Score : 7.5
(CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)

Family: Gentoo Local Security Checks

Nessus Plugin ID: 18384 (gentoo_GLSA-200505-20.nasl)

Bugtraq ID:

CVE ID: CVE-2005-1520
CVE-2005-1521
CVE-2005-1522
CVE-2005-1523