Ipswitch Imail 7.04 vulnerabilities

Hi all, Below are vulnerabilities I have found in Imail Ipswitch.com. Some of them can be very dangerous and it is there for recommended that Imail users upgrade their software asap. After reporting these vulnerabilities to Ipswitch on the 4e of this month it only took 7 days before Ipswitch...

CVE-1999-1448

Affected software: Eudora and Eudora Light before 3.05. Vulnerable component: e-mail processing using dates in messages. Root cause: certain dates cause Divide By Zero errors (dates before 1970) or segmentation faults (dates ~100 years after current date). Impact: remote attacker could cause a cr...

CVE-1999-1525

Macromedia Shockwave before 6.0 allows a malicious webmaster to read a user's mail box and possibly access internal web servers via the GetNextText command on a Shockwave movie...

CVE-1999-1448

Eudora and Eudora Light before 3.05 allows remote attackers to cause a crash and corrupt the user's mailbox via an e-mail message with certain dates, such as 1 dates before 1970, which cause a Divide By Zero error, or 2 dates that are 100 years after the current date, which causes a segmentation...

CVE-1999-1448: Undefined Security Weakness

Eudora and Eudora Light before 3.05 allows remote attackers to cause a crash and corrupt the user's mailbox via an e-mail message with certain dates, such as 1 dates before 1970, which cause a Divide By Zero error, or 2 dates that are 100 years after the current date, which causes a segmentation...

Обратный путь в cobalt qube webmail (directory traversal)

Обратный путь в директориях при обращении к почтовому ящику...

lmail local root exploit

lmail is vulnerable to an insecure mktemp race which allows a user to overwrite or create a files. Offending code lmail.c: define MAILTMPFILE "/tmp/rmXXXXXX" ... static char tempfname = MAILTMPFILE; ... if fseekstdin, 0L, 0 != 0 mailfile = fopenmktemptempfname, "w+"; ... Patch: s/mktemp/mkstemp/g...

GroupWise 5.5 User Mailbox Authentication Vulnerability

Advisory ID Internal CORE-2001-0626 GroupWise 5.5 User Mailbox Authentication Vulnerability Core Security Advisory https://www.coresecurity.com Date Published: 2001-06-26 Advisory ID: CORE-2001-0626 Bugtraq ID: None currently assigned. CVE Name: None currently assigned. Title: GroupWise 5.5 User...

SECURITY.NNOV: Netscape 4.7x Messanger user information retrival

There are known bugs in Netscape which require information on user's files location. This bug is not serious one, but it allows to get this location. Topic : Netscape 4.7x user information retrival Author : 3APA3A [email protected] Affected software : Netscape 4.7x All Platforms Vendor :...

Netscape 4.7x information retrival

Author : 3APA3A Affected software : Netscape 4.7x All Platforms Vendor : Netscape IPlanet Risk : Low Remotely Exploitable : Yes Released : 30 May 2001 Vendor URL : http://www.netscape.com SECURITY.NNOV advisories: http://www.security.nnov.ru/advisories Background: Netscape Messanger uses internal...

unsafe fgets() in qpopper

Topic: unix mailbox parsing trouble in qpopper Software affected: qpopper 3.0 fc2 and probably others Description: malicious user can remotely post message with spoofed or incorrect headers including "Received:" one and in some cases bypass virus checking. This can be used for sending trojans or ...

CVE-2000-0319

CVE-2000-0319 concerns Sendmail prior to 8.10.0, specifically the mail.local component. The vulnerability arises from improper handling of the end-of-message sequence, the dot on a line (".\n"), causing remote denial of service or mailbox corruption for message lines up to 2047 characters. Affect...

CVE-2000-0320

CVE-2000-0320 affects Qpopper 2.53 and 3.0, where the POP server fails to correctly identify the end-of-message delimiter, allowing a remote attacker to cause denial of service or mailbox corruption via a crafted 1023-character line ending with a newline. Root cause: improper parsing of the end-o...

CVE-2000-0320

Qpopper 2.53 and 3.0 does not properly identify the \n string which identifies the end of message text, which allows a remote attacker to cause a denial of service or corrupt mailboxes via a message line that is 1023 characters long and ends in \n...

CVE-2000-0319: Undefined Security Weakness

mail.local in Sendmail 8.10.x does not properly identify the .\n string which identifies the end of message text, which allows a remote attacker to cause a denial of service or corrupt mailboxes via a message line that is 2047 characters long and ends in .\n...

Ошибка между imapd И mail.local

Hello, Надеюсь, что хотя бы из чувства патриотизма может быть еще кто-нибудь в дальнейшем решится писать в этот список рассылки до или хотя бы одновременно публикации в Bugtraq : Ошибка несерьезная, но достаточно интересная. Дело в том, что в данном случае ни одна из программ не содержит явной...

re: Re[4]: mailbox parsing problem in imap-4.7c

On Thu, 10 Aug 2000 22:22:27 +0400, 3APA3A wrote: sendmail contains mail.local. mail.local is MDA. At least BSD distributions use mail.local from sendmail. Well, we'll have to hear what the sendmail people say then. I still contend that all lines that are in "From " header format should be quoted...

mailbox format incopatibility in (WU)imap with mail.local

Title : mailbox format incompatibility in WUimap with mail.local Authors : [email protected], [email protected] Impact : malicious user can put message with faked headers in user's mailbox bypassing virus protection, buffer overflow protection and another MTA/MDA filters. Also imap itself or MUA...

Re: Re[4]: mailbox parsing problem in imap-4.7c

3APA3A [email protected] wrote: Hello Mark, Thursday, August 10, 2000, 9:14:25 PM, you wrote: MC This is not a sendmail issue, since sendmail is an MTA, not an MDA. Sendmail MC calls MDA programs. Sendmail works splendidly for us. sendmail contains mail.local. mail.local is MDA. At least BS...

Re[2]: mailbox parsing problem in imap-4.7c

Hello Mark, I have tested MDAs of different vendors under few OSs. All of them assume empty line to be at the end of message. Most of them comment out "From " in any "nnFrom " pattern. At least qpoper and BSD mail check for empty line under any supported OS and I never heard of any problem becaus...