Secunia

Ulf Härnhammar has discovered some vulnerabilities in Metamail, which can be exploited by malicious people to compromise a user's system.

The vulnerabilities are caused due to various boundary and format string errors when parsing messages and can be exploited when a user opens a specially crafted message.

1) A format string error in the "SaveSquirrelFile()" function can be exploited by sending a specially crafted message containing a "multipart/alternative" media type and format specifiers in the "Content-Type" header.

2) A format string error in the "PrintHeader()" function when handling messages containing certain encoded characters in mail headers can be exploited by including format specifiers.

3) A boundary error in the "PrintHeader()" function during handling of messages containing encoded non-ASCII characters in mail headers can be exploited to cause a buffer overflow by including an overly long string as character set.

4) A boundary error in the "ShareThisHeader()" function in splitmail can be exploited via a specially crafted message containing an overly long "Subject" header.

Successful exploitation allows execution of arbitrary code on a user's system.

The vulnerabilities affect version 2.7 and prior.

Solution
Use another product.

Provided and/or discovered by
Ulf Härnhammar

Changelog
Further details available in Customer Area

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area