Debian: Security Advisory (DSA-533)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DSA-917-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 5.04 / 5.10 / 6.06 LTS : courier vulnerability (USN-294-1)

A Denial of Service vulnerability has been found in the function for encoding email addresses. Addresses containing a '=' before the '@' character caused the Courier to hang in an endless loop, rendering the service unusable. Note that Tenable Network Security has extracted the preceding...

GLSA-200704-18 : Courier-IMAP: Remote execution of arbitrary code

The remote host is affected by the vulnerability described in GLSA-200704-18 Courier-IMAP: Remote execution of arbitrary code CJ Kucera has discovered that some Courier-IMAP scripts don't properly handle the XMAILDIR variable, allowing for shell command injection. Impact : A remote attacker could...

Design/Logic Flaw

Eval injection vulnerability in 1 courier-imapd.indirect and 2 courier-pop3d.indirect in Courier-IMAP before 4.0.6-r2, and 4.1.x before 4.1.2-r1, on Gentoo Linux allows remote attackers to execute arbitrary commands via the XMAILDIR variable, related to the LOGINRUN variable...

CVE-2007-2173

Eval injection vulnerability in 1 courier-imapd.indirect and 2 courier-pop3d.indirect in Courier-IMAP before 4.0.6-r2, and 4.1.x before 4.1.2-r1, on Gentoo Linux allows remote attackers to execute arbitrary commands via the XMAILDIR variable, related to the LOGINRUN variable...

CVE-2007-2173

Eval injection vulnerability in 1 courier-imapd.indirect and 2 courier-pop3d.indirect in Courier-IMAP before 4.0.6-r2, and 4.1.x before 4.1.2-r1, on Gentoo Linux allows remote attackers to execute arbitrary commands via the XMAILDIR variable, related to the LOGINRUN variable...

CVE-2007-2173

CVE-2007-2173 affects Courier-IMAP (courier-imapd.indirect) and courier-pop3d.indirect on Gentoo Linux, with vulnerable versions: Courier-IMAP prior to 4.0.6-r2 and 4.1.x prior to 4.1.2-r1. The flaw is an eval injection via the XMAILDIR variable (related to LOGINRUN), allowing remote attackers to...

CVE-2007-2173: Undefined Security Weakness

Eval injection vulnerability in 1 courier-imapd.indirect and 2 courier-pop3d.indirect in Courier-IMAP before 4.0.6-r2, and 4.1.x before 4.1.2-r1, on Gentoo Linux allows remote attackers to execute arbitrary commands via the XMAILDIR variable, related to the LOGINRUN variable...

[Full-disclosure] [ GLSA 200704-18 ] Courier-IMAP: Remote execution of arbitrary code

Gentoo Linux Security Advisory GLSA 200704-18 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity:...

Courier-IMAP shell characters problem

Invalid usage of XMAILDIR environment variable controlled by attacker thorugh logon request in the scripts courier-imapd.indirect and courier-pop3d.indirect...

Courier-IMAP: Remote execution of arbitrary code

Background Courier-IMAP is an IMAP server which is part of the Courier mail system. It provides access only to maildirs. Description CJ Kucera has discovered that some Courier-IMAP scripts don't properly handle the XMAILDIR variable, allowing for shell command injection. Impact A remote attacker...

Debian DSA-917-1 : courier - programming error

Patrick Cheong Shu Yang discovered that courier-authdaemon, the authentication daemon of the Courier Mail Server, grants access to accounts that are already deactivated. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

Debian DSA-1101-1 : courier - programming error

A bug has been discovered in the Courier Mail Server that can result in a number of processes to consume arbitrary amounts of CPU power. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-110...

Courier MTA: Denial of Service vulnerability

Background Courier MTA is an integrated mail and groupware server based on open protocols. Description Courier MTA has fixed a security issue relating to usernames containing the "=" character, causing high CPU utilization. Impact An attacker could exploit this vulnerability by sending a speciall...

GLSA-200608-06 : Courier MTA: Denial of Service vulnerability

The remote host is affected by the vulnerability described in GLSA-200608-06 Courier MTA: Denial of Service vulnerability Courier MTA has fixed a security issue relating to usernames containing the '=' character, causing high CPU utilization. Impact : An attacker could exploit this vulnerability ...

[SECURITY] [DSA 1101-1] New courier packages fix denial of service

-------------------------------------------------------------------------- Debian Security Advisory DSA 1101-1 [email protected] http://www.debian.org/security/ Martin Schulze June 23rd, 2006 http://www.debian.org/security/faq -...

DSA-1101 courier - programming error

Bulletin has no description...

Courier Mail Server < 0.53.2 Crafted Username Encoding DoS

Binary data 3646.prm...

USN-294-1: courier vulnerability

A Denial of Service vulnerability has been found in the function for encoding email addresses. Addresses containing a '=' before the '@' character caused the Courier to hang in an endless loop, rendering the service unusable...