Vulnerability Assessment & Network Security Forums



If through a vulnerability assessment, a network security issue is detected for the vulnerability below, applying the appropriate security patches in a timely matter is very important.  If you have detected that your system has already been compromised, following CERT's Network Security recovery document will assist with recommended steps for system recovery.


Home >> Browse Vulnerability Assessment Database >> Debian Local Security Checks >> [DSA248] DSA-248-1 hypermail


Vulnerability Assessment Details

[DSA248] DSA-248-1 hypermail

Vulnerability Assessment Summary
DSA-248-1 hypermail

Detailed Explanation for this Vulnerability Assessment

Ulf Härnhammar discovered two problems in hypermail, a program to
create HTML archives of mailing lists.
A possible hacker could craft a long filename for an attachment that would
overflow two buffers when a certain option for interactive use was
given, opening the possibility to inject arbitrary code. This code
would then be executed under the user id hypermail runs as, mostly as
a local user. Automatic and silent use of hypermail does not seem to
be affected.
The CGI program mail, which is not installed by the Debian package,
does a reverse look-up of the user's IP number and copies the
resulting hostname into a fixed-size buffer. A specially crafted DNS
reply could overflow this buffer, opening the program to an exploit.
For the stable distribution (woody) this problem has been fixed in
version 2.1.3-2.0.
For the old stable distribution (potato) this problem has been fixed
in version 2.0b25-1.1.
For the unstable distribution (sid) this problem has been fixed
in version 2.1.6-1.
We recommend that you upgrade your hypermail packages.


Solution : http://www.debian.org/security/2003/dsa-248
Network Security Threat Level: High

Networks Security ID: 6689, 6690

Vulnerability Assessment Copyright: This script is (C) 2005 Michel Arboi

Cables, Connectors

Apple samsung 512GB PCIe SSD MZ-JPV512S/0A4 for Macbook Air and MacBook Pro
$225.0
Apple samsung 512GB PCIe SSD MZ-JPV512S/0A4 for Macbook Air and MacBook Pro pictureGenuine Cow Leather Book Case Cover for Samsung SM-P905 4G Galaxy Note Pro 12.2
$31.63
Genuine Cow Leather Book Case Cover for Samsung SM-P905 4G Galaxy Note Pro 12.2 pictureBlack PU Leather Case Hard Cover w/ Hand Strap For Samsung Galaxy Tab S2 9.7"
$2.99
Black PU Leather Case Hard Cover w/ Hand Strap For Samsung Galaxy Tab S2 9.7Samsung Galaxy Tab S3 9.7 9H Protective glass Laminated Tempered Bulletproof New
$12.91
Samsung Galaxy Tab S3 9.7 9H Protective glass Laminated Tempered Bulletproof New picture


Discussions

No Discussions have been posted on this vulnerability.