|
|
Family: Gain a shell remotely --> Category: mixed
GNU Mailutils <= 0.6 Multiple Vulnerabilities Vulnerability Scan
Vulnerability Scan Summary
Checks for multiple vulnerabilities in GNU Mailutils <= 0.6
Detailed Explanation for this Vulnerability Test
Synopsis :
The remote mail server is affected by multiple issues.
Description :
GNU Mailutils is a collection of mail utilities, including an IMAP4
daemon, a POP3 daemon, and a very simple mail client.
The remote host is running a version of GNU Mailutils containing
several critical flaws in its IMAP4 daemon and its mail client 'mail'.
By exploiting these issues, a remote attacker can cause a denial of
service in the IMAP4 daemon and execute code remotely, either in the
context of a local user or the user executing the daemon process,
typically root.
In addition, it may suffer from a SQL injection flaw if configured to
work with MySQL or Postgres. A possible hacker may be able to exploit this
flaw to modify database queries when mailutils tries to authenticate a
user, leading to disclosure of sensitive information or modification
of data.
See also :
http://www.idefense.com/application/poi/display?id=246&type=vulnerabilities
http://archives.neohapsis.com/archives/bugtraq/2005-07/0474.html
Solution :
Upgrade to GNU Mailutils 0.6.90 or later.
Threat Level:
High / CVSS Base Score : 7
(AV:R/AC:L/Au:NR/C:P/A:P/I:P/B:N)
Click HERE for more information and discussions on this network vulnerability scan.
|
