Qpopper pop_msg() Macroname Remote Overflow

2003-03-10T00:00:00
ID OSVDB:9794
Type osvdb
Reporter OSVDB
Modified 2003-03-10T00:00:00

Description

Vulnerability Description

A remote overflow exists in Qpopper. The server fails to properly check the length of macronames supplied to the pop_msg() function resulting in a buffer overflow. With a specially crafted request, an attacker can cause a denial of service or potentially execute arbitrary code. This attack requires valid user authentication credentials.

Solution Description

Upgrade to version 4.0.5fc2 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Short Description

A remote overflow exists in Qpopper. The server fails to properly check the length of macronames supplied to the pop_msg() function resulting in a buffer overflow. With a specially crafted request, an attacker can cause a denial of service or potentially execute arbitrary code. This attack requires valid user authentication credentials.

References:

ISS X-Force ID: 11516 CVE-2003-0143 Bugtraq ID: 7058