Horde library Bug part 2

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Horde Library $from Bug part 2 + How to exploit with IMP and Sendmail Description: The Fix of the first detected problem with the $from variable in the horde library was just escaping shellchars which avoids directly executing commands. It is still...

Re: Re[4]: mailbox parsing problem in imap-4.7c

3APA3A [email protected] wrote: Hello Mark, Thursday, August 10, 2000, 9:14:25 PM, you wrote: MC This is not a sendmail issue, since sendmail is an MTA, not an MDA. Sendmail MC calls MDA programs. Sendmail works splendidly for us. sendmail contains mail.local. mail.local is MDA. At least BS...

re: Re[4]: mailbox parsing problem in imap-4.7c

On Thu, 10 Aug 2000 22:22:27 +0400, 3APA3A wrote: sendmail contains mail.local. mail.local is MDA. At least BSD distributions use mail.local from sendmail. Well, we'll have to hear what the sendmail people say then. I still contend that all lines that are in "From " header format should be quoted...

Ошибки в mail.local

Некорректное использование fgets в mail.local из sendmail 8.10.0 и 8.10.1 дает возможность повредить ящик пользователя путем подмены заголовка "Content-Length: ". В более старых версиях sendmail имеется возможность вставить LMTP команды в тело письма...

Local root vulnerability in most used Linux kernels

There is a zeroday exploit for kernel in hands of scriptkiddies. After they rooted locally 2 system which I've intrest and did dd if=/dev/zero of=/dev/hda1 & on both, I spended 7 hours to finding fragments we really need easies tools LDE with GUI block search capabilities This with help of Peter ...

Sendmail Workaround for Linux Capabilities Bug

-----BEGIN PGP SIGNED MESSAGE----- SENDMAIL SECURITY TEAM ADVISORY Sendmail Workaround for Linux Capabilities Bug The Sendmail Consortium and Sendmail, Inc. has been informed of a serious problem in the Linux kernel that can be used to get root access. This is not a sendmail security problem,...

Linux Kernel 2.2.x 2.4.0-test1 (SGI ProPack 1.21.3) - Sendmail Capabilities Privilege Escalation(1)

Linux Kernel 2.2.x 2.4.0-test1 SGI ProPack 1.21.3 - Sendmail Capabilities Privilege Escalation1 / source: https://www.securityfocus.com/bid/1322/info POSIX "Capabilities" have recently been implemented in the Linux kernel. These "Capabilities" are an additional form of privilege control to enable...

Linux Kernel 2.2.x 2.4.0-test1 (SGI ProPack 1.2/1.3) - Sendmail 8.10.1 Capabilities Privilege Escalation (2)

source: https://www.securityfocus.com/bid/1322/info POSIX "Capabilities" have recently been implemented in the Linux kernel. These "Capabilities" are an additional form of privilege control to enable more specific control over what priviliged processes can do. Capabilities are implemented as thre...

Linux Kernel 2.2.x 2.4.0-test1 (SGI ProPack 1.21.3) - Sendmail 8.10.1 Capabilities Privilege Escalation (2)

Linux Kernel 2.2.x 2.4.0-test1 SGI ProPack 1.21.3 - Sendmail 8.10.1 Capabilities Privilege Escalation 2 source: https://www.securityfocus.com/bid/1322/info POSIX "Capabilities" have recently been implemented in the Linux kernel. These "Capabilities" are an additional form of privilege control to...

Linux Kernel 2.2.x 2.4.0-test1 (SGI ProPack 1.2/1.3) - Sendmail Capabilities Privilege Escalation(1)

/ source: https://www.securityfocus.com/bid/1322/info POSIX "Capabilities" have recently been implemented in the Linux kernel. These "Capabilities" are an additional form of privilege control to enable more specific control over what priviliged processes can do. Capabilities are implemented as...

CVE-1999-0976

Sendmail allows local users to reinitialize the aliases database via the newaliases command, then cause a denial of service by interrupting Sendmail...

CVE-1999-0976

CVE-1999-0976 concerns Sendmail. The affected component is the local-mail transfer agent; the vulnerability allows local users to reinitialize the aliases database via the newaliases command, which can lead to a denial of service by interrupting Sendmail. The provided data notes a low-severity im...

Linux news 14.05.00

Linux 2.3.99-pre8 Вышло новое ядро из нестабильной серии - 2.3.99-pre8 Подробнее: http://www.kernel.org Wonderful World of Linux 2.4 Final Candidate 4 5/12/00 Появилась очередная версия статьи - Wonderful World of Linux 2.4, в которой рассказывается о новых возможностях следующего ядра Linux -...

Re: unsafe fgets() in sendmail's mail.local

On Mon, Apr 24, 2000, 3APA3A wrote: Topic: unsafe fgets in sendmail's mail.local 1. Possibility to insert LMTP commands into e-mail message 2. Possibility of deadlock between sendmail and mail.local 3. Possibility to corrupt user's mailbox 4. Possibility to change e-mail headers of the message in...

CVE-1999-0203

In Sendmail, attackers can gain root privileges via SMTP by specifying an improper "mail from" address and an invalid "rcpt to" address that would cause the mail to bounce to a program...

CVE-1999-0203

CVE-1999-0203 affects Sendmail. The vulnerability arises when an SMTP session uses an improper MAIL FROM and an invalid RCPT TO that cause a bounce to a program, enabling an attacker to gain root privileges on the host. Several connected entries corroborate the issue and describe the impact as re...

unsafe fgets() in sendmail's mail.local

Topic: unsafe fgets in sendmail's mail.local Description: There are 4 problems: 1. Possibility to insert LMTP commands into e-mail message 2. Possibility of deadlock between sendmail and mail.local 3. Possibility to corrupt user's mailbox 4. Possibility to change e-mail headers of the message in...

CVE-2000-0319

mail.local in Sendmail 8.10.x does not properly identify the .\n string which identifies the end of message text, which allows a remote attacker to cause a denial of service or corrupt mailboxes via a message line that is 2047 characters long and ends in .\n...

unsafe fgets() in sendmail's mail.local

Topic: unsafe fgets in sendmail's mail.local Description: There are 4 problems: 1. Possibility to insert LMTP commands into e-mail message 2. Possibility of deadlock between sendmail and mail.local 3. Possibility to corrupt user's mailbox 4. Possibility to change e-mail headers of the message in...

Linux news 11.04.00

Linuxconf 1.17r10 Вышла новая версия мощной утилиты конфигурирования Linux систем. Это т.н. bugfix release. Пофиксен баг в модуле pppdialin ошибка в ppplogin и в модуле inetdconf. Подробнее: http://www.appwatch.com Возрожденная Amiga строит мультимедийную Linux-платформу Gateway строила грандиозн...