re: Re[4]: mailbox parsing problem in imap-4.7c

On Thu, 10 Aug 2000 22:22:27 +0400, 3APA3A wrote: sendmail contains mail.local. mail.local is MDA. At least BSD distributions use mail.local from sendmail. Well, we'll have to hear what the sendmail people say then. I still contend that all lines that are in "From " header format should be quoted...

Ошибка между imapd И mail.local

Hello, Надеюсь, что хотя бы из чувства патриотизма может быть еще кто-нибудь в дальнейшем решится писать в этот список рассылки до или хотя бы одновременно публикации в Bugtraq : Ошибка несерьезная, но достаточно интересная. Дело в том, что в данном случае ни одна из программ не содержит явной...

Emurl2.0.windows

Affected Product: Emurl 2.0 For Windows NT 4.0 possibly others Product information: Emurl is web-based email host developped by SeattleLab. http://www1.seattlelab.com/emurl/ Impact: Users can access the mailbox's content of anybody on the system. They can also steal their POP passwords since Emur...

Re: unsafe fgets() in sendmail's mail.local

On Mon, Apr 24, 2000, 3APA3A wrote: Topic: unsafe fgets in sendmail's mail.local 1. Possibility to insert LMTP commands into e-mail message 2. Possibility of deadlock between sendmail and mail.local 3. Possibility to corrupt user's mailbox 4. Possibility to change e-mail headers of the message in...

unsafe fgets() in sendmail's mail.local

Topic: unsafe fgets in sendmail's mail.local Description: There are 4 problems: 1. Possibility to insert LMTP commands into e-mail message 2. Possibility of deadlock between sendmail and mail.local 3. Possibility to corrupt user's mailbox 4. Possibility to change e-mail headers of the message in...

FreeBSD-SA-00:15.imap-uw

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-00:15 Security Advisory FreeBSD, Inc. Topic: imap-uw allows local users to deny service to any mailbox Category: ports Module: imap-uw Announced: 2000-04-24 Credits: Alex...

CVE-2000-0319

mail.local in Sendmail 8.10.x does not properly identify the .\n string which identifies the end of message text, which allows a remote attacker to cause a denial of service or corrupt mailboxes via a message line that is 2047 characters long and ends in .\n...

unsafe fgets() in sendmail's mail.local

Topic: unsafe fgets in sendmail's mail.local Description: There are 4 problems: 1. Possibility to insert LMTP commands into e-mail message 2. Possibility of deadlock between sendmail and mail.local 3. Possibility to corrupt user's mailbox 4. Possibility to change e-mail headers of the message in...

unix mailbox parsing trouble in qpopper

Topic: unix mailbox parsing trouble in qpopper Software affected: qpopper 3.0 fc2 and probably others Description: malicious user can remotely post message with spoofed or incorrect headers including "Received:" one and in some cases bypass virus checking. This can be used for sending trojans or ...

PT-2000-1070 · Microsoft · Hotmail

Name of the Vulnerable Software and Affected Versions: Hotmail affected versions not specified Description: The issue concerns the improper filtering of JavaScript code from a user's mailbox. This allows a remote attacker to execute JavaScript code by using hexadecimal codes to specify the...

PT-2000-1074 · Microsoft · Hotmail

Name of the Vulnerable Software and Affected Versions: Hotmail affected versions not specified Description: The issue arises from improper filtering of JavaScript code in a user's mailbox, allowing a remote attacker to execute code. This can be achieved via the LOWSRC or DYNRC parameters in the I...

poc.mail.local.txt

Proof of Concept - Security Advisory 02/15/99 http://poc.csoft.net Released by [email protected] [email protected] --- Affected Program mail.local Berkeley Sendmail Description Local mailer forward mail to mailboxes Severity Mailbox compromise Synopsis: mail.local is a small program distributed wit...

pine.4.xx.lockfile.txt

Date: Sun, 5 Mar 1999 01:41:25 +0100 From: Michal Zalewski Lockfile vunerability in pine 4.xx Linux The problem is probably well known, but silently ignored by pine vendors. Unfortunately, it's possible to turn 'mostly harmless feature' in something nasty - following code allows various DoSes by...

sendmail-8.9.1.txt

Date: Thu, 9 Jul 1998 19:31:52 +0200 From: Michal Zalewski Subject: Sendmail up to 8.9.1 - mail.local instroduces new class of bugs Local, setuid mail delivery program included in recent packages - mail.local - introduces new class of local bugs, from DoS attacks to security compromises. For...

ipop3d.4.xx.lockfile.DoS.txt

Date: Sun, 7 Mar 1999 01:41:25 +0100 From: Michal Zalewski Lockfile vunerability in ipop3d 4.xx The problem is probably well known, but silently ignored by pine vendors. Unfortunately, it's possible to turn 'mostly harmless feature' in something nasty - following code allows various DoSes by...

University of Washington pop2d 4.4 - Remote Buffer Overflow

University of Washington pop2d 4.4 - Remote Buffer Overflow // source: https://www.securityfocus.com/bid/283/info A buffer overflow vulnerability in pop2d version 4.4 or earlier allow malicious remote users to obtain access to the "nobody" user account. The pop2 and pop3 servers support the conce...

University of Washington pop2d 4.4 - Remote Buffer Overflow

// source: https://www.securityfocus.com/bid/283/info A buffer overflow vulnerability in pop2d version 4.4 or earlier allow malicious remote users to obtain access to the "nobody" user account. The pop2 and pop3 servers support the concept of an "anonymous proxy", whereby a remote user connecting...

CVE-1999-1448

Eudora and Eudora Light before 3.05 allows remote attackers to cause a crash and corrupt the user's mailbox via an e-mail message with certain dates, such as 1 dates before 1970, which cause a Divide By Zero error, or 2 dates that are 100 years after the current date, which causes a segmentation...

CVE-1999-1525

Macromedia Shockwave before 6.0 allows a malicious webmaster to read a user's mail box and possibly access internal web servers via the GetNextText command on a Shockwave movie...

Can't finish the E-discovery process for an on-premises mailbox (KB5019807)

None None...