POP3Lite Input Validation Vulnerability
BID:3278
Info
POP3Lite Input Validation Vulnerability
| Bugtraq ID: | 3278 |
| Class: | Input Validation Error |
| CVE: |
CVE-2001-0996 |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 03 2001 12:00AM |
| Updated: | Jul 11 2009 07:56AM |
| Credit: | This vulnerability disclosed by Daniel Roethlisberger <[email protected]> on September 3rd, 2001. |
| Vulnerable: |
POP3Lite POP3Lite 0.2.3 b POP3Lite POP3Lite 0.2.3 |
| Not Vulnerable: |
POP3Lite POP3Lite 0.2.4 |
Discussion
POP3Lite Input Validation Vulnerability
POP3Lite is a free, open-source compact POP3 daemon for Linux and BSD systems.
POP3Lite has an input validation problem which may be exploited by remote attackers. POP3Lite will not escape leading dots('.') from e-mail it transfers. At the very least this may cause unusual behavior to occur, but may be manipulated to malicious effect. This may allow an attacker to pass arbitrary server responses to the mail client of a user retrieving mail from a POP3Lite server.
Remote attackers may exploit this issue to inject messages or cause messages to be lost. A potential for mail-spoofing attacks also exists as message headers can be falsified. A denial of services may also result, depending on how the client interprets the malicious input.
POP3Lite is a free, open-source compact POP3 daemon for Linux and BSD systems.
POP3Lite has an input validation problem which may be exploited by remote attackers. POP3Lite will not escape leading dots('.') from e-mail it transfers. At the very least this may cause unusual behavior to occur, but may be manipulated to malicious effect. This may allow an attacker to pass arbitrary server responses to the mail client of a user retrieving mail from a POP3Lite server.
Remote attackers may exploit this issue to inject messages or cause messages to be lost. A potential for mail-spoofing attacks also exists as message headers can be falsified. A denial of services may also result, depending on how the client interprets the malicious input.
Solution / Fix
POP3Lite Input Validation Vulnerability
Solution:
The vendor has addressed this issue in version 0.2.4.
POP3Lite POP3Lite 0.2.3 b
POP3Lite POP3Lite 0.2.3
Solution:
The vendor has addressed this issue in version 0.2.4.
POP3Lite POP3Lite 0.2.3 b
-
Debian POP3Lite 0.4.2a-1 unstable
http://packages.debian.org/unstable/mail/pop3lite.html -
POP3Lite POP3Lite
ftp://pop3lite.sourceforge.net/pub/pop3lite/
POP3Lite POP3Lite 0.2.3
-
Debian POP3Lite 0.4.2a-1 unstable
http://packages.debian.org/unstable/mail/pop3lite.html -
POP3Lite POP3Lite
ftp://pop3lite.sourceforge.net/pub/pop3lite/