Debian DSA-373-1 : autorespond - buffer overflow

Christian Jaeger discovered a buffer overflow in autorespond, an email autoresponder used with qmail. This vulnerability could potentially be exploited by a remote attacker to gain the privileges of a user who has configured qmail to forward messages to autorespond. This vulnerability is currentl...

[Full-Disclosure] Lame crash in qmail-smtpd and memory overwrite according to gdb, yet still qmail much better than windows

Georgi Guninski security advisory 65, 2004 Lame crash in qmail-smtpd and memory overwrite according to gdb, yet still qmail much better than windows Systems affected: qmail 1.03 on linux, don't know about other OSes. Risk: Unknown. maybe so, maybe no. Date: 15 January 2004 Legal Notice: This...

qmail integer overflow

Inger overflow on the message with line over 2Gb...

CVE-2003-0654

Buffer overflow in autorespond may allow remote attackers to execute arbitrary code as the autorespond user via qmail...

CVE-2003-0654

Buffer overflow in autorespond may allow remote attackers to execute arbitrary code as the autorespond user via qmail...

CVE-2003-0654

CVE-2003-0654 describes a buffer overflow in autorespond (an email autoresponder used with qmail). The flaw could allow remote attackers to execute arbitrary code as the autorespond user via qmail. Public sources (NVD, Debian DSA-373-1) document this as a remote vulnerability with a base CVSS v2 ...

qmail starttls patch does not seed the random number generator

openssl-0.9.6b does not allow ssl/tls connections when the random number has not been seeded. This is a good idea, and it exposes that the starttls patch for qmail does not seed the random number generator. Here is a small patch that fixes the problem in qmail-remote for systems that support...

Проблемы с шифрованием в qmail (weak encryption)

Не инициализируется генератор псевдо-случайных чисел...

vpopmail-3.4.11 problems

The vpopmail package is an extension for Qmail that allows easy management of virtual domains and can use a SQL backend for storing user accounts. The program vchkpw in that package contains a vulnerability in its logging routines. The vchkpw program handles the username/password/domain...

CVE-1999-0250

Denial of service in Qmail through long SMTP commands...

CVE-1999-0144

CVE-1999-0144 describes a denial-of-service in Qmail caused by issuing an RCPT command with a large number of recipients. The Red Hat, CVE, and NVD records concur this is a DoS condition related to RCPT handling, with impact to availability. The connected documents provided do not include concret...

CVE-1999-0250

Technical details about CVE-1999-0250 are not publicly available in the provided documents. No information on affected product versions, root cause specifics, or fixes is included. Monitor for updates.

CVE-1999-0144

Denial of service in Qmail by specifying a large number of recipients with the RCPT command...

vpopmail.txt

w00w00 Security Advisory - http://www.w00w00.org/ Title: qmail-pop3d with vpopmail/vchkpw Platforms: Any Discovered: 7th January, 2000 Local: Yes. Remote: Yes. Author: K2 Vendor Status: Notified. Last Updated: N/A 1. Overview qmail-pop3d may pass an overly long command argument to it's password...

Inter7 vpopmail (vchkpw) 3.4.11 - Local Buffer Overflow

// source: https://www.securityfocus.com/bid/942/info Vpopmail vchkpw is free GPL software package built to help manage virtual domains and non /etc/passwd email accounts on Qmail mail servers. This package is developed by Inter7 Referenced in the 'Credit' section and is not shipped, maintained o...

Inter7 vpopmail (vchkpw) 3.4.11 - Local Buffer Overflow

Inter7 vpopmail vchkpw 3.4.11 - Local Buffer Overflow // source: https://www.securityfocus.com/bid/942/info Vpopmail vchkpw is free GPL software package built to help manage virtual domains and non /etc/passwd email accounts on Qmail mail servers. This package is developed by Inter7 Referenced in...

iis4.0.smtp.DoS.txt

Date: Tue, 16 Feb 1999 14:03:43 -0600 From: Bug Traqqer To: [email protected] Subject: Re: IIS 4.0 SMTPSVC vs. QMAIL To all- if you find this problem happening to you there are fixes on both product sides. Qmail has provided a patch for stray line feeds. It is available through the...

qmail-DoS.txt

Date: Mon, 4 Jan 1999 00:04:09 -0500 From: Wietse Venema To: [email protected] Subject: Anonymous Qmail Denial of Service In recent postings, Daniel Bernstein expands on the insecurity of the Postfix world-writable directory for local mail submission. Of all the attacks possible with such a...

CVE-1999-0250

Denial of service in Qmail through long SMTP commands...

Dan Bernstein QMail 1.0 3 - RCPT Denial of Service (1)

Dan Bernstein QMail 1.0 3 - RCPT Denial of Service 1 source: https://www.securityfocus.com/bid/2237/info qmail is an e-mail server package developed by Dan Bernstein. The qmail smtp server is subject to a denial of service. By specifying a large number of addresses in the recipient field RCPT,...