Secunia

Georgi Guninski has reported a vulnerability in qmail, which can be exploited by malicious people to compromise a vulnerable system.

A signedness error in the "commands()" function in commands.c can be exploited to corrupt memory via specially crafted data passed via qpopup/qpop3d or potentially qmail-smtpd.

Successful exploitation allows execution of arbitrary code, but only affects 64-bit systems with about 10GB of virtual memory.

Various types of other errors, which also potentially can be exploited to execute code, have also been reported.

The vulnerability has been reported in version 1.0.3. Other versions may also be affected.

Solution
Set proper per-process memory limits.

Provided and/or discovered by
Georgi Guninski

Changelog
Further details available in Customer Area

Original Advisory
Georgi Guninski:
http://www.guninski.com/where_do_you_want_billg_to_go_today_4.html

Deep Links
Links available in Customer Area