RHEL 2.1 : metamail (RHSA-2006:0217)

High Nessus Plugin ID 20966


The remote Red Hat host is missing a security update.


An updated metamail package that fixes a buffer overflow vulnerability for Red Hat Enterprise Linux 2.1 is now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Metamail is a system for handling multimedia mail.

A buffer overflow bug was found in the way Metamail processes certain mail messages. An attacker could create a carefully-crafted message such that when it is opened by a victim and parsed through Metamail, it runs arbitrary code as the victim. The Common Vulnerabilities and Exposures project (cve.mitre.org) assigned the name CVE-2006-0709 to this issue.

Users of Metamail should upgrade to this updated package, which contains a backported patch that is not vulnerable to this issue.


Update the affected metamail package.

See Also



Plugin Details

Severity: High

ID: 20966

File Name: redhat-RHSA-2006-0217.nasl

Version: $Revision: 1.17 $

Type: local

Agent: unix

Published: 2006/02/22

Modified: 2016/12/29

Dependencies: 12634

Risk Information

Risk Factor: High


Base Score: 7.5

Temporal Score: 6.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:POC/RL:U/RC:ND

Vulnerability Information

CPE: p-cpe:/a:redhat:enterprise_linux:metamail, cpe:/o:redhat:enterprise_linux:2.1

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2006/02/21

Vulnerability Publication Date: 2006/02/12

Reference Information

CVE: CVE-2006-0709

BID: 16611

OSVDB: 23159

RHSA: 2006:0217