Erwin Lansing mailidx Input Validation Vulnerability

Bugtraq ID:	3822
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 04 2002 12:00AM
Updated:	Jan 04 2002 12:00AM
Credit:	Published in the mailidx changelog on January 4, 2002.
Vulnerable:	Erwin Lansing mailidx 20010925
Not Vulnerable:	Erwin Lansing mailidx 20020105

Erwin Lansing mailidx Input Validation Vulnerability

Erwin Lansing's mailidx scripts are capable of parsing a unix mailbox and storing the messages in a database. It attempts to sort messages by mailling list through the use of regular expressions. A collection of PHP/CGI scripts are provided as an example frontend for the database collection, including the ability to search the messages.

The search script does not properly validate user supplied input. As a result, a malicious user with access to this script may be able to provide input which will modify an SQL statement. Depending on details of the installation, sensitive information may be disclosed. It may also be possible to modify the information stored within the database.

Erwin Lansing mailidx Input Validation Vulnerability

No exploit code is required to take advantage of this issue.

Erwin Lansing mailidx Input Validation Vulnerability

Solution:
An updated version of mailidx has been made available:


Erwin Lansing mailidx 20010925

• Erwin Lansing mailidx-20020105.tar.gz
  http://dl.droso.net/mailidx-20020105.tar.gz

Erwin Lansing mailidx Input Validation Vulnerability

References:

• mailidx Homepage (Erwin Lansing)