vulnerability in mail.local

hi, mail.local is a little setuid root prog designed, like its name suggest, for local mail delivering. Used with the -l option, we have an interactive mode in lmtp protocol simplified smtp for local mail delivery only A weakness exists in the 'mail from' field that allow any local user to insert...

Ошибки в mail.local

Некорректное использование fgets в mail.local из sendmail 8.10.0 и 8.10.1 дает возможность повредить ящик пользователя путем подмены заголовка "Content-Length: ". В более старых версиях sendmail имеется возможность вставить LMTP команды в тело письма...

unsafe fgets() in sendmail's mail.local

Topic: unsafe fgets in sendmail's mail.local Description: There are 4 problems: 1. Possibility to insert LMTP commands into e-mail message 2. Possibility of deadlock between sendmail and mail.local 3. Possibility to corrupt user's mailbox 4. Possibility to change e-mail headers of the message in...