|
Metamail Message Parsing System Compromise Vulnerabilities
|
|
Secunia Advisory:
|
SA10908
|
|
|
Release Date:
|
2004-02-18
|
|
Last Update:
|
2004-02-25
|
|
Popularity:
|
12,055 views
|
|
|
Critical:
|
Highly critical
|
|
Impact:
|
System access
|
|
Where:
|
From remote
|
|
Solution Status:
|
Unpatched
|
|
| Software: | Metamail 2.x
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
| CVE reference: | CVE-2004-0104
CVE-2004-0105
|
|
Description:
Ulf Härnhammar has discovered some vulnerabilities in Metamail, which can be exploited by malicious people to compromise a user's system.
The vulnerabilities are caused due to various boundary and format string errors when parsing messages and can be exploited when a user opens a specially crafted message.
1) A format string error in the "SaveSquirrelFile()" function can be exploited by sending a specially crafted message containing a "multipart/alternative" media type and format specifiers in the "Content-Type" header.
2) A format string error in the "PrintHeader()" function when handling messages containing certain encoded characters in mail headers can be exploited by including format specifiers.
3) A boundary error in the "PrintHeader()" function during handling of messages containing encoded non-ASCII characters in mail headers can be exploited to cause a buffer overflow by including an overly long string as character set.
4) A boundary error in the "ShareThisHeader()" function in splitmail can be exploited via a specially crafted message containing an overly long "Subject" header.
Successful exploitation allows execution of arbitrary code on a user's system.
The vulnerabilities affect version 2.7 and prior.
Solution:
Use another product.
Provided and/or discovered by:
Ulf Härnhammar
Changelog:
2004-02-19: Added more information.
2004-02-25: Added CERT references.
Other References:
CERT VU#518518
http://www.kb.cert.org/vuls/id/518518
CERT VU#513062
http://www.kb.cert.org/vuls/id/513062
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
