The imap4d server for GNU Mailutils 0.5 and 0.6, and other versions before 0.6.90, allows authenticated remote users to cause a denial of service (CPU consumption) via a large range value in the FETCH command.

'infamous41md' discovered several vulnerabilities in the GNU mailutils package which contains utilities for handling mail. These problems can lead to a denial of service or the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities.

  - CAN-2005-1520     Buffer overflow mail header handling may allow a remote     attacker to execute commands with the privileges of the     targeted user.

  - CAN-2005-1521

    Combined integer and heap overflow in the fetch routine     can lead to the execution of arbitrary code.

  - CAN-2005-1522

    Denial of service in the fetch routine.

  - CAN-2005-1523

    Format string vulnerability can lead to the execution of     arbitrary code.

The remote host is affected by the vulnerability described in GLSA-200505-20 (Mailutils: Multiple vulnerabilities in imap4d and mail)

    infamous41d discovered several vulnerabilities in GNU Mailutils.
    imap4d does not correctly implement formatted printing of command tags     (CAN-2005-1523), fails to validate the range sequence of the 'FETCH'     command (CAN-2005-1522), and contains an integer overflow in the     'fetch_io' routine (CAN-2005-1521). mail contains a buffer overflow in     'header_get_field_name()' (CAN-2005-1520).
  Impact :

    A remote attacker can exploit the format string and integer     overflow in imap4d to execute arbitrary code as the imap4d user, which     is usually root. By sending a specially crafted email message, a remote     attacker could exploit the buffer overflow in the 'mail' utility to     execute arbitrary code with the rights of the user running mail.
    Finally, a remote attacker can also trigger a Denial of Service by     sending a malicious FETCH command to an affected imap4d, causing     excessive resource consumption.
  Workaround :

    There are no known workarounds at this time.

GNU Mailutils is a collection of mail utilities, including an IMAP4 daemon, a POP3 daemon, and a very simple mail client. 

The remote host is running a version of GNU Mailutils containing several critical flaws in its IMAP4 daemon and its mail client 'mail'. By exploiting these issues, a remote attacker can cause a denial of service in the IMAP4 daemon and execute code remotely, either in the context of a local user or the user executing the daemon process, typically root. 

In addition, it may suffer from a SQL injection flaw if configured to work with MySQL or Postgres.  An attacker may be able to exploit this flaw to modify database queries when mailutils tries to authenticate a user, leading to disclosure of sensitive information or modification of data.

The remote host is running GNU Mailutils, an open source package that includes tools for running and managing a mail server.  This version of GNU Mailutils is vulnerable to several remote buffer overflows.  An attacker exploiting these flaws will be able to execute arbitrary code.

ID	Name	Product	Family	Severity
18519	Debian DSA-732-1 : mailutils - several vulnerabilities	Nessus	Debian Local Security Checks	high
18384	GLSA-200505-20 : Mailutils: Multiple vulnerabilities in imap4d and mail	Nessus	Gentoo Local Security Checks	high
18371	GNU Mailutils <= 0.6 Multiple Vulnerabilities	Nessus	Gain a shell remotely	high
2938	GNU Mailutils Multiple IMAP Vulnerabilities	Nessus Network Monitor	POP Server	medium

Detections

Analytics

CVE-2005-1522

medium

Tenable Plugins

high

high

high

medium