Postfix vulnerable to DoS by supplying a remote SMTP listener with a malformed envelope address

Overview A denial-of-service vulnerability exists in all versions of Postfix prior to 2.0. This vulnerability may allow a remote attacker to cause mail service interruption. Description Postfix is a very popular mail transfer agent MTA. Michal Zalewski has discovered a denial-of-service...

NetBSD OSI protocol DoS

Delivery error packet generation problem...

O UT LO OK E XPRE SS 6 .00 : broken

Saturday, February 22, 2003 Technical silent delivery and installation of an executable no client input other than reading an email or viewing a newsgroup message. Outlook Express 6.00 SP1 Cumulative Pack 1 2 3 4 whatever. This should not be possible. When viewing an email message or a newsgroup...

DEBIAN-CVE-2002-1313

nullmailer 1.00RC5 and earlier allows local users to cause a denial of service via an email to a local user that does not exist, which generates an error that causes nullmailer to stop sending mail to all users...

FreeBSD-SA-02:41.smrsh

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-02:41.smrsh Security Advisory The FreeBSD Project Topic: smrsh restrictions can be bypassed REVISED Category: core Module: contribsendmail Announced: 2002-11-15 Credits:...

WHERE'S THE CA$H: Internet Explorer 6.00. Outlook Express 6.00

Saturday, July 27, 2002 Trivial lead-up to yet another silent delivery and installation of an executable on the target computer using Outlook Express 6. This can be achieved combining several past possibilities, specifically the following: http://www.securityfocus.com/bid/1033...

ISS Brief: Remote Buffer Overflow Vulnerability in Microsoft Exchange Server

TO UNSUBSCRIBE: email "unsubscribe alert" in the body of your message to [email protected] Contact [email protected] for help with any problems! --------------------------------------------------------------------------- -----BEGIN PGP SIGNED MESSAGE----- Internet Security Systems Security Brie...

Microsoft Windows SMTP Service Malformed BDAT Request Remote DoS

It is possible to make the remote SMTP server fail and restart by sending specially crafted 'BDAT' requests. The service will restart automatically, but all the connections established at the time of the attack will be dropped. An attacker may use this flaw to make mail delivery to your site less...

Microsoft PowerPoint and Excel fail to properly detect macros thereby automatically executing malicious code via crafted document (MS01-050)

Overview A malformed Microsoft Excel or PowerPoint document can bypass macro checking thereby allowing arbitrary code to be run on the target system. Description Microsoft Excel and PowerPoint scan documents when they are opened and check for the existence of macros. If the document contains...

[Fwd: Failed mail]

Well I tried to mail this to the SCO / Caldera security aliases but they keep bouncing back so I will send it here instead... this is regarding the recent DT overflows on OpenUnix8. -KF -------- Original Message -------- Subject: Failed mail Date: Mon, 1 Oct 2001 17:08:31 PDT From: MMDF Mail Syst...

Vulnerable SSL Implementation in iCDN

...

lmail local root exploit

lmail is vulnerable to an insecure mktemp race which allows a user to overwrite or create a files. Offending code lmail.c: define MAILTMPFILE "/tmp/rmXXXXXX" ... static char tempfname = MAILTMPFILE; ... if fseekstdin, 0L, 0 != 0 mailfile = fopenmktemptempfname, "w+"; ... Patch: s/mktemp/mkstemp/g...

Lmail 2.7 - Temporary File Race Condition

// source: https://www.securityfocus.com/bid/2984/info Jon Zeeff's lmail is a local mail delivery agent LDA designed to provide mail-to-pipe and mail-to-file aliasing for smail. A race condition vulnerability exists in lmail. The lmail program makes insecure use of temporary files, making it...

Lmail 2.7 - Temporary File Race Condition

Lmail 2.7 - Temporary File Race Condition // source: https://www.securityfocus.com/bid/2984/info Jon Zeeff's lmail is a local mail delivery agent LDA designed to provide mail-to-pipe and mail-to-file aliasing for smail. A race condition vulnerability exists in lmail. The lmail program makes...

feeble.you!dora.exploit

Sunday, March 18, 2001 Silent delivery and installation of an executable on a target computer. No client input other than opening an email using Eudora 5.02 - Sponsored Mode provided 'use Microsoft viewer' and 'allow executables in HTML content' are enabled. One wonders why they are there in the...

Re[2]: mailbox parsing problem in imap-4.7c

Hello Mark, I have tested MDAs of different vendors under few OSs. All of them assume empty line to be at the end of message. Most of them comment out "From " in any "nnFrom " pattern. At least qpoper and BSD mail check for empty line under any supported OS and I never heard of any problem becaus...

Re: Re[4]: mailbox parsing problem in imap-4.7c

3APA3A [email protected] wrote: Hello Mark, Thursday, August 10, 2000, 9:14:25 PM, you wrote: MC This is not a sendmail issue, since sendmail is an MTA, not an MDA. Sendmail MC calls MDA programs. Sendmail works splendidly for us. sendmail contains mail.local. mail.local is MDA. At least BS...

mailbox format incopatibility in (WU)imap with mail.local

Title : mailbox format incompatibility in WUimap with mail.local Authors : [email protected], [email protected] Impact : malicious user can put message with faked headers in user's mailbox bypassing virus protection, buffer overflow protection and another MTA/MDA filters. Also imap itself or MUA...

silent.delivery.txt

Saturday, May 13, 2000 MICROSOFT SECURITY FLAW? Silent delivery and installation of an executable on a target computer. No client input other than opening an email or newsgroup post. 1. Using the following this can be accomplished with the default installation of Windows 95 and 98 and Internet...

CVE-2000-0216

Affected software: Microsoft email clients (Outlook, Exchange, Windows Messaging). Vulnerability: servers/clients automatically respond to Read Receipt and Delivery Receipt tags. Root cause: auto-generated responses to receipt requests, enabling amplification by redirecting to a large distributio...