MMMail Remote SysLog Format String Vulnerability
BID:4999
Info
MMMail Remote SysLog Format String Vulnerability
| Bugtraq ID: | 4999 |
| Class: | Input Validation Error |
| CVE: |
CVE-2002-0925 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 12 2002 12:00AM |
| Updated: | Jul 11 2009 01:56PM |
| Credit: | Vulnerability discovery credited to Guillaume Pelat. |
| Vulnerable: |
Matthew Mondor mmmail 0.0.13 Matthew Mondor mmmail 0.0.12 Matthew Mondor mmmail 0.0.11 |
| Not Vulnerable: |
Matthew Mondor mmmail 0.0.14 |
Discussion
MMMail Remote SysLog Format String Vulnerability
mmmail is a freely available, open source mail software package. It was written originally by Matthew Mondor, and is available for the Linux operating system.
Due to improper use of the syslog call, a problem exists which could make the execution of arbitrary code possible. A syslog call in the program which logs user-supplied information could be exploited to print to specified places in memory, including potentially overwriting the return address of a function and executing arbitrary code.
mmmail is a freely available, open source mail software package. It was written originally by Matthew Mondor, and is available for the Linux operating system.
Due to improper use of the syslog call, a problem exists which could make the execution of arbitrary code possible. A syslog call in the program which logs user-supplied information could be exploited to print to specified places in memory, including potentially overwriting the return address of a function and executing arbitrary code.
Exploit / POC
MMMail Remote SysLog Format String Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
MMMail Remote SysLog Format String Vulnerability
Solution:
Update available:
Matthew Mondor mmmail 0.0.11
Matthew Mondor mmmail 0.0.12
Matthew Mondor mmmail 0.0.13
Solution:
Update available:
Matthew Mondor mmmail 0.0.11
-
Matthew Mondor mmmail-0.0.14.tar.gz
http://mmondor.gobot.ca/software/linux/mmmail-0.0.14.tar.gz
Matthew Mondor mmmail 0.0.12
-
Matthew Mondor mmmail-0.0.14.tar.gz
http://mmondor.gobot.ca/software/linux/mmmail-0.0.14.tar.gz
Matthew Mondor mmmail 0.0.13
-
Matthew Mondor mmmail-0.0.14.tar.gz
http://mmondor.gobot.ca/software/linux/mmmail-0.0.14.tar.gz
References
MMMail Remote SysLog Format String Vulnerability
References:
References:
- mmmail Changelog (Matthew Mondor)
- Software Page (Matthew Mondor)