Vulnerability Assessment & Network Security Forums



If through a vulnerability assessment, a network security issue is detected for the vulnerability below, applying the appropriate security patches in a timely matter is very important.  If you have detected that your system has already been compromised, following CERT's Network Security recovery document will assist with recommended steps for system recovery.


Home >> Browse Vulnerability Assessment Database >> Debian Local Security Checks >> [DSA248] DSA-248-1 hypermail


Vulnerability Assessment Details

[DSA248] DSA-248-1 hypermail

Vulnerability Assessment Summary
DSA-248-1 hypermail

Detailed Explanation for this Vulnerability Assessment

Ulf Härnhammar discovered two problems in hypermail, a program to
create HTML archives of mailing lists.
A possible hacker could craft a long filename for an attachment that would
overflow two buffers when a certain option for interactive use was
given, opening the possibility to inject arbitrary code. This code
would then be executed under the user id hypermail runs as, mostly as
a local user. Automatic and silent use of hypermail does not seem to
be affected.
The CGI program mail, which is not installed by the Debian package,
does a reverse look-up of the user's IP number and copies the
resulting hostname into a fixed-size buffer. A specially crafted DNS
reply could overflow this buffer, opening the program to an exploit.
For the stable distribution (woody) this problem has been fixed in
version 2.1.3-2.0.
For the old stable distribution (potato) this problem has been fixed
in version 2.0b25-1.1.
For the unstable distribution (sid) this problem has been fixed
in version 2.1.6-1.
We recommend that you upgrade your hypermail packages.


Solution : http://www.debian.org/security/2003/dsa-248
Network Security Threat Level: High

Networks Security ID: 6689, 6690

Vulnerability Assessment Copyright: This script is (C) 2005 Michel Arboi

Cables, Connectors

Dell PowerConnect 3324 24-Port Rack Mountable Switch
$34.95
Dell PowerConnect 3324 24-Port Rack Mountable Switch pictureRuckus R700 ZoneFlex R700 Dual Band 802.11ac Indoor Access Point 901-R700-US00
$495.0
Ruckus R700  ZoneFlex R700 Dual Band 802.11ac Indoor Access Point 901-R700-US00  pictureDell PowerConnect 5524 24 Ports Gigabit Ethernet Switch 2GPFC 02GPFC HDMI X2
$155.0
Dell PowerConnect 5524 24 Ports Gigabit Ethernet Switch 2GPFC 02GPFC HDMI X2 picture8 PORT FAST ETHERNET SWITCH
$10.0
8 PORT FAST ETHERNET SWITCH picture


Discussions

No Discussions have been posted on this vulnerability.