[SECURITY] [DSA 4692-1] netqmail security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4692-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 24, 2020 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4692-1] netqmail security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4692-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 24, 2020 https://www.debian.org/security/faq -...

PT-2020-3627

Name of the Vulnerable Software and Affected Versions netqmail version 1.06 Description The issue is related to the qmail-verify module in the netqmail email client, which lacks protection for service data. This can allow an attacker to gain access to confidential data. A local attacker can test...

CVE-2005-1514

commands.c in qmail, when running on 64 bit platforms with a large amount of virtual memory, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long SMTP command without a space character, which causes an array to be referenced with a negative index...

CVE-2005-1513

Integer overflow in the strallocreadyplus function in qmail, when running on 64 bit platforms with a large amount of virtual memory, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large SMTP request...

UBUNTU-CVE-2005-1515

Integer signedness error in the qmailput and substdioput functions in qmail, when running on 64 bit platforms with a large amount of virtual memory, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large number of SMTP RCPT TO commands...

UBUNTU-CVE-2005-1514

commands.c in qmail, when running on 64 bit platforms with a large amount of virtual memory, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long SMTP command without a space character, which causes an array to be referenced with a negative index...

UBUNTU-CVE-2005-1513

Integer overflow in the strallocreadyplus function in qmail, when running on 64 bit platforms with a large amount of virtual memory, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large SMTP request...

Qualys Security Advisory - Qmail Remote Code Execution

Qualys Security Advisory 15 years later: Remote Code Execution in qmail CVE-2005-1513 ======================================================================== Contents ======================================================================== Summary Analysis Exploitation qmail-verify - CVE-2020-38...

PT-2020-3626

Name of the Vulnerable Software and Affected Versions netqmail version 1.06 Description The issue is related to a lack of input validation in the qmail-verify module of the netqmail email client. This can be exploited by a remote attacker to compromise data integrity. The vulnerability allows for...

Qmail SMTP - Bash Environment Variable Injection (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Qmail SMTP Bash Environment Variable Injection Shellshock', 'Description' = %q This module exploits a shellshock vulnerability on Qmail, a public...

Qmail SMTP Bash Environment Variable Injection (Shellshock) Exploit

This Metasploit module exploits a shellshock vulnerability on Qmail, a public domain MTA written in C that runs on Unix systems. Due to the lack of validation on the MAIL FROM field, it is possible to execute shell code on a system with a vulnerable BASH Shellshock. This flaw works on the latest...

Qmail SMTP Bash Environment Variable Injection (Shellshock)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Qmail SMTP Bash Environment Variable Injection Shellshock', 'Description' = %q This module exploits a shellshock vulnerability on Qmail, a public...

GLSA-201409-09 : Bash: Code Injection (Shellshock)

The remote host is affected by the vulnerability described in GLSA-201409-09 Bash: Code Injection Stephane Chazelas reported that Bash incorrectly handles function definitions, allowing attackers to inject arbitrary code. Impact : A remote attacker could exploit this vulnerability to execute...

Qmail Remote Command Execution via Shellshock

The remote host appears to be running Qmail. A remote attacker can exploit Qmail to execute commands via a specially crafted MAIL FROM header if the remote host has a vulnerable version of Bash. This is due to the fact that Qmail does not properly sanitize input before setting environmental...

Oracle Linux 5 / 6 / 7 : bash (ELSA-2014-1293)

The remote Oracle Linux 5 / 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2014-1293 advisory. 4.1.2-15.1 - Check for fishy environment Resolves: 1141645 Tenable has extracted the preceding description block directly from the Oracle Linux security...

Qmail SMTP Bash Environment Variable Injection (Shellshock)

This module exploits a shellshock vulnerability on Qmail, a public domain MTA written in C that runs on Unix systems. Due to the lack of validation on the MAIL FROM field, it is possible to execute shell code on a system with a vulnerable BASH Shellshock. This flaw works on the latest Qmail...

Inter7 vpopmail (vchkpw) <= 3.4.11 Buffer Overflow Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/942/info Vpopmail vchkpw is free GPL software package built to help manage virtual domains and non /etc/passwd email accounts on Qmail mail servers. This package is developed by Inter7 Referenced in the 'Credit' section a...

Dan Bernstein QMail 1.0 3 RCPT Denial of Service Vulnerability (2)

No description provided by source. source: http://www.securityfocus.com/bid/2237/info qmail is an e-mail server package developed by Dan Bernstein. The qmail smtp server is subject to a denial of service. By specifying a large number of addresses in the recipient field RCPT, qmail will stop...

Dan Bernstein QMail 1.0 3 RCPT Denial of Service Vulnerability (1)

No description provided by source. source: http://www.securityfocus.com/bid/2237/info qmail is an e-mail server package developed by Dan Bernstein. The qmail smtp server is subject to a denial of service. By specifying a large number of addresses in the recipient field RCPT, qmail will stop...