iDEFENSE Security Advisory 04.08.05: Microsoft Multiple E-Mail Client Address Spoofing Vulnerability

Microsoft Multiple E-Mail Client Address Spoofing Vulnerability iDEFENSE Security Advisory 04.08.05 http://www.idefense.com/application/poi/display?type=vulnerabilities April 8, 2005 I. BACKGROUND Microsoft Outlook provides an integrated solution for managing and organizing e-mail messages,...

CVE-2002-1601

The Connectables feature in Adobe PhotoDeluxe 3.1 prepends the Adobe directory to the CLASSPATH environment variable, which allows applets to run with higher privileges and remote attackers to gain privileges via an HTML e-mail message or a web page...

CVE-2004-1731

signuppage.php in Mantis bugtracker allows remote attackers to send e-mail bombs by creating multiple users and providing the same e-mail address...

CVE-2004-1731

CVE-2004-1731 affects the Mantis bugtracker, specifically signup_page.php, where remote attackers could create multiple users and provide the same e-mail address to trigger mass e-mail behavior. The vulnerability enables sending e-mail bombs; exploitation details (methods, likelihood, and in-the-...

CVE-2005-0493

The CVE-2005-0493 issue affects Biz Mail Form’s BizMail CGI (bizmail.cgi) prior to version 2.2. A CRLF injection in the email parameter lets remote, unauthenticated attackers bypass the email check and relay spam by crafting email headers via CRLF sequences. The impact is remote abuse of the mail...

CVE-2005-0493

CRLF injection vulnerability in bizmail.cgi in Biz Mail Form before 2.2 allows remote attackers to bypass the email check and send spam e-mail via CRLF sequences and forged mail headers in the email parameter...

HP-UX PHSS_14592 : s700_800 11.00 Predictive C.11.0[0,a-e] cumulative patch

s700800 11.00 Predictive C.11.00,a-e cumulative patch : Fixes a problem with the e-mail or modem traffic to and from on-site customer machines and Response Center Predictive machines. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and patch checks in this plugin were...

CVE-2004-1468

CVE-2004-1468 affects Webmin 1.x and Usermin 1.x. The webmail feature contains an input validation bug that allows a remote attacker to execute arbitrary commands by sending specially crafted e-mails with shell metacharacters, leading to remote code execution with the privileges of the Webmin/Use...

CVE-2005-0337

Postfix 2.1.3, when /proc/net/ifinet6 is not available and permitmxbackup is enabled in smtpdrecipientrestrictions, allows remote attackers to bypass e-mail restrictions and perform mail relaying by sending mail to an IPv6 hostname...

CVE-2004-0270

CVE-2004-0270 affects the ClamAV ecosystem, specifically libclamav 0.65. A remote attacker can trigger a denial-of-service by sending a malformed uuencoded e‑mail message with an invalid line length, causing an assert failure in clamd that terminates the calling process. The description in multip...

CESA-2004-001: libpng

CESA-2004-001 - rev 3 libPNG 1.2.5 stack-based buffer overflow and other code concerns ================================================================ Programs : libpng users including mozilla, konqueror, various e-mail clients, generally lots. Also reports that some versions of IE are vulnerabl...

Microsoft Outlook 2003 - Mail Client E-mail Address Verification

source: https://www.securityfocus.com/bid/10323/info It has been reported that Microsoft Outlook mail client may be prone to a weakness that could allow a remote attacker to verify the validity of a recipient's e-mail address. This issue may result in a victim receiving more junk e-mail. Microsof...

ZA Security Hole

Hello! I think, I discover some kind of security hole in ZoneAlaram - any version. The problem is hidding in E-mail Protection. Because I'm form Slovenia not Slovakia, our alphabet does have some letters with roof c - , s - , z - . And when the name of e-mail attachment contain any of these three...

ClamAV Daemon 0.65 - UUEncoded Message Denial of Service

source: https://www.securityfocus.com/bid/9610/info A problem in the handling of specially crafted UUEncoded messages has been identified in ClamAV. Because of this, an attacker may prevent the delivery of e-mail to users. Save the following file to /clamtest.mbox: From - begin 644 byebye byebye...

CVE-2003-1423

Petitforum stores the liste.txt data file under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information such as e-mail addresses and encrypted passwords...

DSR-korean-elm.pl

DSR-korean-elm.pl - kokaninATdtors.net vs. /usr/ports/korean/elm offset, retaddr and shellcode is for my FreeBSD 4.7-RELEASE, YMMV reinventing the wheel, http://www.insecure.org/sploits/elm.curses.overflow.html shellcode by zillionATsafemode.org ko-elm-2.4h4.1 ELM Mail User Agent, patched for...

CVE-2003-0285

IBM AIX 5.2 and earlier distributes Sendmail with a configuration file sendmail.cf with the 1 promiscuousrelay, 2 acceptunresolvabledomains, and 3 acceptunqualifiedsenders features enabled, which allows Sendmail to be used as an open mail relay for sending spam e-mail...

CVE-2002-0738

CVE-2002-0738 concerns MHonArc up to version 2.5.2 and earlier, where archiving HTML mail could allow remote script execution in web clients. The root cause is inadequate filtering of Javascript within archived messages, enabling tricks such as breaking SCRIPT tags, using SCRIPT in an IMG SRC, or...

CVE-2002-0914

Double Precision Courier e-mail MTA allows remote attackers to cause a denial of service CPU consumption via a message with an extremely large or negative value for the year, which causes a tight loop...

outblaze.txt

========================================== INetCop Security Advisory 2003-0x82-014.b ========================================== Title: ++Danger++ Outblaze Web based e-mail that is exposed in very dangerous state !!! 0x01. Description Hackermail.com Outblaze Web based e-mail is mail service that I...