KMail HTML Mail Handling Denial Of Service Vulnerability

Bugtraq ID:	20369
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 06 2006 12:00AM
Updated:	Oct 12 2006 07:49PM
Credit:	nnp <[email protected]> has been credited with the discovery of this vulnerability.
Vulnerable:	KDE kmail 1.90 KDE kmail 1.89 KDE kmail 1.88 KDE kmail 1.87 KDE kmail 1.86.2 36 KDE kmail 1.9.1 KDE kmail 1.7.1 + KDE KDE 3.3.2 + KDE KDE 3.3.2 KDE kmail 1.3.1 + KDE KDE 2.2.1 + KDE KDE 2.2 KDE kmail 1.2 + KDE kdelibs 2.1.1
Not Vulnerable:

KMail HTML Mail Handling Denial Of Service Vulnerability

KMail is prone to an unspecified denial-of-service vulnerability.

An attacker can exploit this issue to crash the affected application, denying service to legitimate users.

KMail 1.9.1 and prior versions are vulnerable to this issue.

KMail HTML Mail Handling Denial Of Service Vulnerability

An attacker may trigger this issue by constructing a malicious email message and sending it to a vulnerable server.

The following email message demonstrates this issue.

• /data/vulnerabilities/exploits/20369.html

KMail HTML Mail Handling Denial Of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].

KMail HTML Mail Handling Denial Of Service Vulnerability

References:

• Kmail <= 1.9.1 (latest) DOS (nnp )
  
• KMail Home Page (KMail)