Secunia

infamous41md has reported four vulnerabilities in GNU Mailutils, which can be exploited to cause a DoS (Denial of Service) or compromise a vulnerable system.

1) An integer overflow in the "fetch_io()" function in imap4d/fetch.c when handling partial message requests can be exploited by malicious users to cause a heap-based buffer overflow.

Successful exploitation allows execution of arbitrary code.

2) An input validation error in the imap4d service during processing of FETCH commands can be exploited by malicious users to cause the service to consume a large amount of memory resources via a specially crafted sequence range.

3) A format string error in the imap4d service when handling command tags can be exploited by malicious people to execute arbitrary code via a specially crafted string containing format specifiers.

4) A coding error in the "header_get_field_name()" function in mailbox/header.c can be exploited to cause a buffer overflow via a specially crafted email.

Successful exploitation allows execution of arbitrary code.

The vulnerabilities have been reported in versions 0.5 and 0.6. Other versions may also be affected.

Solution
The vulnerabilities have been fixed in version 0.6.90.

Provided and/or discovered by
infamous41md

Original Advisory
iDEFENSE:
http://www.idefense.com/application/poi/display?id=249&type=vulnerabilities
http://www.idefense.com/application/poi/display?id=248&type=vulnerabilities
http://www.idefense.com/application/poi/display?id=247&type=vulnerabilities
http://www.idefense.com/application/poi/display?id=246&type=vulnerabilities

Deep Links
Links available in Customer Area