A vulnerability has been reported in XMail, which can be exploited by malicious, local users to gain escalated privileges.

The vulnerability is caused due to a boundary error in the "AddressFromAtPtr()" function when copying the hostname portion of an e-mail address to a 256-byte buffer. This can be exploited to cause a stack-based buffer overflow via a specially crafted email address passed to the "-t" command line option.

Successful exploitation allows arbitrary code execution with escalated privileges. The RPM binary distribution of XMail reportedly installs the binary with setuid root privileges. Other distribution installs the binary setgid mail.

The vulnerability has been reported in version 1.21.

Solution
Update to version 1.22.
Further details available in Customer Area

Provided and/or discovered by
Discovered by anonymous person and reported via iDEFENSE.

Original Advisory
iDEFENSE:
http://www.idefense.com/application/poi/display?id=321&type=vulnerabilities

Deep Links
Links available in Customer Area