Libremail Pop.c Remote Format String Vulnerability

Bugtraq ID:	15906
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 16 2005 12:00AM
Updated:	Dec 16 2005 12:00AM
Credit:	Discovered by Mehdi Oudad "deepfear" from the Zone-H Research Team.
Vulnerable:	Libremail Libremail 1.1
Not Vulnerable:

Libremail Pop.c Remote Format String Vulnerability

Libremail is susceptible to a remote format string vulnerability.

This issue presents itself in the 'pop.c' file, when the application processes specially crafted data from a POP server.

This issue allows remote attackers to execute arbitrary machine code in the context of the affected application. A denial of service condition may arise due to failed exploitation attempts as well.

Libremail 1.1.0 and prior versions are affected.

Libremail Pop.c Remote Format String Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Libremail Pop.c Remote Format String Vulnerability

Solution:
The vendor has released updated source code files to address this issue. Users are advised to obtain updates files from the following location:

http://libremail.tuxfamily.org/en/dersources.htm

Libremail Pop.c Remote Format String Vulnerability

References:

• Libremail Home Page (Libremail)
  
• ZRCSA-200505: libremail - "pop.c" Format String Vulnerability ([email protected])