ClamAV: Denial of service

Background ClamAV is a GPL virus scanner. Description Hendrik Weimer discovered that ClamAV fails to properly handle deeply nested MIME multipart/mixed content. Impact By sending a specially crafted email with deeply nested MIME multipart/mixed content an attacker could cause ClamAV to crash...

CVE-2006-6481

Clam AntiVirus ClamAV 0.88.6 allows remote attackers to cause a denial of service stack overflow and application crash by wrapping many layers of multipart/mixed content around a document, a different vulnerability than CVE-2006-5874 and CVE-2006-6406...

CVE-2006-6481

CVE-2006-6481 affects ClamAV 0.88.6. The vulnerability allows a remote attacker to cause a denial of service through crafted multipart/mixed content that leads to a stack overflow and application crash. This is described as a different vulnerability from CVE-2006-5874 and CVE-2006-6406. The provi...

CVE-2006-6481

Clam AntiVirus ClamAV 0.88.6 allows remote attackers to cause a denial of service stack overflow and application crash by wrapping many layers of multipart/mixed content around a document, a different vulnerability than CVE-2006-5874 and CVE-2006-6406...

CVE-2006-6481: Undefined Security Weakness

Clam AntiVirus ClamAV 0.88.6 allows remote attackers to cause a denial of service stack overflow and application crash by wrapping many layers of multipart/mixed content around a document, a different vulnerability than CVE-2006-5874 and CVE-2006-6406...

CVE-2006-6407

F-Prot Antivirus for Linux x86 Mail Servers 4.6.6 allows remote attackers to bypass virus detection by inserting invalid characters into base64 encoded content in a multipart/mixed MIME file, as demonstrated with the EICAR test file...

CVE-2006-6406: Undefined Security Weakness

Clam AntiVirus ClamAV 0.88.6 allows remote attackers to bypass virus detection by inserting invalid characters into base64 encoded content in a multipart/mixed MIME file, as demonstrated with the EICAR test file...

CVE-2006-6408: Undefined Security Weakness

Kaspersky Anti-Virus for Linux Mail Servers 5.5.10 allows remote attackers to bypass virus detection by inserting invalid characters into base64 encoded content in a multipart/mixed MIME file, as demonstrated with the EICAR test file...

CVE-2006-6409: Undefined Security Weakness

F-Secure Anti-Virus for Linux Gateways 4.65 allows remote attackers to cause a denial of service possibly fatal scan error, and possibly bypass virus detection, by inserting invalid characters into base64 encoded content in a multipart/mixed MIME file, as demonstrated with the EICAR test file...

CVE-2006-6407: Undefined Security Weakness

F-Prot Antivirus for Linux x86 Mail Servers 4.6.6 allows remote attackers to bypass virus detection by inserting invalid characters into base64 encoded content in a multipart/mixed MIME file, as demonstrated with the EICAR test file...

Multiple Vendor Unusual MIME Encoding Content Filter Bypass

Several e-mail virus scanners can be tricked into passing an EICAR test file if the following conditions are met: 1. the EICAR file is encoded in Base64 including characters not in the standard alphabet e.g. whitespaces and 2. the part containing the EICAR file is nested within one or several...

Code injection

jetty 6.0.x jetty6 beta16 allows remote attackers to read arbitrary script source code via a capital P in the .jsp extension, and probably other mixed case manipulations...

Directory traversal

Directory traversal vulnerability in dwnld.php in GuppY 4.5.11 allows remote attackers to overwrite arbitrary files via a "%2E." mixed encoding in the pg parameter...

CVE-2004-2214

The affected component is the Mbedthis AppWeb HTTP server, with versions prior to 1.1.3 vulnerable. The issue allows remote attackers to bypass access restrictions by a URI containing mixed-case characters. Remediation: upgrade to version 1.1.3 or later. No exploit details are provided in the sou...

CVE-2004-2214

Mbedthis AppWeb HTTP server before 1.1.3 allows remote attackers to bypass access restrictions via a URI with mixed case characters...

security flaw

CUPS before 1.1.21rc1 treats a Location directive in cupsd.conf as case sensitive, which allows attackers to bypass intended ACLs via a printer name containing uppercase or lowercase letters that are different from what is specified in the directive...

Novell NetMail 3.x - Automatic Script Execution

source: https://www.securityfocus.com/bid/14171/info Novell NetMail email client is prone to an input validation vulnerability. Reports indicate that HTML and JavaScript attached to received email messages is executed automatically, when the email message is viewed. A successful attack may allow...

PT-2004-3109 · Embedthis · Mbedthis Appweb Http Server

Name of the Vulnerable Software and Affected Versions: Mbedthis AppWeb HTTP server versions prior to 1.1.3 Description: The issue allows remote attackers to bypass access restrictions via a URI with mixed case characters. Recommendations: For versions prior to 1.1.3, update to version 1.1.3 or...

CVE-2002-0485

Norton Anti-Virus NAV allows remote attackers to bypass content filtering via attachments whose Content-Type and Content-Disposition headers are mixed upper and lower case, which is ignored by some mail clients...

Pine 4.x - Empty MIME Boundary Denial of Service

Pine 4.x - Empty MIME Boundary Denial of Service source: https://www.securityfocus.com/bid/5301/info Pine is an open source mail user agent distributed by the University of Washington. It is freely available for Unix, Linux, and Microsoft Operating Systems. When a mail is received by pine that...