GLSA-200505-20 : Mailutils: Multiple vulnerabilities in imap4d and mail
High Nessus Plugin ID 18384
SynopsisThe remote Gentoo host is missing one or more security-related patches.
DescriptionThe remote host is affected by the vulnerability described in GLSA-200505-20 (Mailutils: Multiple vulnerabilities in imap4d and mail)
infamous41d discovered several vulnerabilities in GNU Mailutils.
imap4d does not correctly implement formatted printing of command tags (CAN-2005-1523), fails to validate the range sequence of the 'FETCH' command (CAN-2005-1522), and contains an integer overflow in the 'fetch_io' routine (CAN-2005-1521). mail contains a buffer overflow in 'header_get_field_name()' (CAN-2005-1520).
A remote attacker can exploit the format string and integer overflow in imap4d to execute arbitrary code as the imap4d user, which is usually root. By sending a specially crafted email message, a remote attacker could exploit the buffer overflow in the 'mail' utility to execute arbitrary code with the rights of the user running mail.
Finally, a remote attacker can also trigger a Denial of Service by sending a malicious FETCH command to an affected imap4d, causing excessive resource consumption.
There are no known workarounds at this time.
SolutionAll GNU Mailutils users should upgrade to the latest available version:
# emerge --sync # emerge --ask --oneshot --verbose '>=net-mail/mailutils-0.6-r1'