Intrusion Prevention

GNU.Mailutils.imap4d.Format.String

Description

This indicates an attack attempt against a format-string vulnerability in the imap4d server in GNU Mailutils.
The vulnerability is caused by an error when the vulnerable software handles malicious data in a command tag for IMAP commands. It allows a remote attacker to execute arbitrary commands by inserting malicious data in a command tag for IMAP commands.

Affected Products

GNU Mailutils 0.6
GNU Mailutils 0.5
Debian Linux 3.0 sparc
Debian Linux 3.0 s/390
Debian Linux 3.0 ppc
Debian Linux 3.0 mipsel
Debian Linux 3.0 mips
Debian Linux 3.0 m68k
Debian Linux 3.0 ia-64
Debian Linux 3.0 ia-32
Debian Linux 3.0 hppa
Debian Linux 3.0 arm
Debian Linux 3.0 alpha
Debian Linux 3.0

Impact

System compromise

Recommended Actions

Apply the appropriate patch.
GNU Mailutils 0.5
GNU mailutils-0.6.90.tar.gz
* ftp://alpha.gnu.org/gnu/mailutils/mailutils-0.6.90.tar.gz
GNU Mailutils 0.6
GNU mailutils-0.6.90.tar.gz
* ftp://alpha.gnu.org/gnu/mailutils/mailutils-0.6.90.tar.gz
Debian Linux 3.0 hppa
Debian libmailutils0-dev_20020409-1woody2_hppa.deb
* Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/m/mailutils/libmailutils0 -dev_20020409-1woody2_hppa.deb
Debian libmailutils0_20020409-1woody2_hppa.deb
* Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/m/mailutils/libmailutils0 _20020409-1woody2_hppa.deb
Debian mailutils-imap4d_20020409-1woody2_hppa.deb
* Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/m/mailutils/mailutils-ima p4d_20020409-1woody2_hppa.deb
Debian mailutils-pop3d_20020409-1woody2_hppa.deb
* Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/m/mailutils/mailutils-pop 3d_20020409-1woody2_hppa.deb
Debian mailutils_20020409-1woody2_hppa.deb
* Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/m/mailutils/mailutils_200 20409-1woody2_hppa.deb
Debian Linux 3.0 ppc
Debian libmailutils0-dev_20020409-1woody2_powerpc.deb
* Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/m/mailutils/libmailutils0 -dev_20020409-1woody2_powerpc.deb
Debian libmailutils0_20020409-1woody2_powerpc.deb
* Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/m/mailutils/libmailutils0 _20020409-1woody2_powerpc.deb
Debian mailutils-imap4d_20020409-1woody2_powerpc.deb
* Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/m/mailutils/mailutils-ima p4d_20020409-1woody2_powerpc.deb
Debian mailutils-pop3d_20020409-1woody2_powerpc.deb
* Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/m/mailutils/mailutils-pop 3d_20020409-1woody2_powerpc.deb
Debian mailutils_20020409-1woody2_powerpc.deb
* Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/m/mailutils/mailutils_200 20409-1woody2_powerpc.deb
Debian Linux 3.0 s/390
Debian libmailutils0-dev_20020409-1woody2_s390.deb
* Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/m/mailutils/libmailutils0 -dev_20020409-1woody2_s390.deb
Debian libmailutils0_20020409-1woody2_s390.deb
* Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/m/mailutils/libmailutils0 _20020409-1woody2_s390.deb
Debian mailutils-imap4d_20020409-1woody2_s390.deb
* Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/m/mailutils/mailutils-ima p4d_20020409-1woody2_s390.deb
Debian mailutils-pop3d_20020409-1woody2_s390.deb
* Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/m/mailutils/mailutils-pop 3d_20020409-1woody2_s390.deb
Debian mailutils_20020409-1woody2_s390.deb
* Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/m/mailutils/mailutils_200 20409-1woody2_s390.deb
Debian Linux 3.0
Debian mailutils-doc_20020409-1woody2_all.deb
* Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/m/mailutils/mailutils-doc _20020409-1woody2_all.deb
Debian Linux 3.0 arm
Debian libmailutils0-dev_20020409-1woody2_arm.deb
* Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/m/mailutils/libmailutils0 -dev_20020409-1woody2_arm.deb
Debian mailutils-imap4d_20020409-1woody2_arm.deb
* Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/m/mailutils/mailutils-ima p4d_20020409-1woody2_arm.deb
Debian mailutils-pop3d_20020409-1woody2_arm.deb
* Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/m/mailutils/mailutils-pop 3d_20020409-1woody2_arm.deb
Debian mailutils_20020409-1woody2_arm.deb
* Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/m/mailutils/mailutils_200 20409-1woody2_arm.deb
Debian Linux 3.0 alpha
Debian libmailutils0-dev_20020409-1woody2_alpha.deb
* Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/m/mailutils/libmailutils0 -dev_20020409-1woody2_alpha.deb
Debian libmailutils0_20020409-1woody2_alpha.deb
* Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/m/mailutils/libmailutils0 _20020409-1woody2_alpha.deb
Debian libmailutils0_20020409-1woody2_arm.deb
* Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/m/mailutils/libmailutils0 _20020409-1woody2_arm.deb
Debian mailutils-imap4d_20020409-1woody2_alpha.deb
* Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/m/mailutils/mailutils-ima p4d_20020409-1woody2_alpha.deb
Debian mailutils-pop3d_20020409-1woody2_alpha.deb
* Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/m/mailutils/mailutils-pop 3d_20020409-1woody2_alpha.deb
Debian mailutils_20020409-1woody2_alpha.deb
* Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/m/mailutils/mailutils_200 20409-1woody2_alpha.deb
Debian Linux 3.0 mips
Debian libmailutils0-dev_20020409-1woody2_mips.deb
* Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/m/mailutils/libmailutils0 -dev_20020409-1woody2_mips.deb
Debian libmailutils0_20020409-1woody2_mips.deb
* Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/m/mailutils/libmailutils0 _20020409-1woody2_mips.deb
Debian mailutils-imap4d_20020409-1woody2_mips.deb
* Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/m/mailutils/mailutils-ima p4d_20020409-1woody2_mips.deb
Debian mailutils-pop3d_20020409-1woody2_mips.deb
* Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/m/mailutils/mailutils-pop 3d_20020409-1woody2_mips.deb
Debian mailutils_20020409-1woody2_mips.deb
* Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/m/mailutils/mailutils_200 20409-1woody2_mips.deb
Debian Linux 3.0 ia-32
Debian libmailutils0-dev_20020409-1woody2_i386.deb
* Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/m/mailutils/libmailutils0 -dev_20020409-1woody2_i386.deb
Debian libmailutils0_20020409-1woody2_i386.deb
* Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/m/mailutils/libmailutils0 _20020409-1woody2_i386.deb
Debian mailutils-imap4d_20020409-1woody2_i386.deb
* Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/m/mailutils/mailutils-ima p4d_20020409-1woody2_i386.deb
Debian mailutils-pop3d_20020409-1woody2_i386.deb
* Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/m/mailutils/mailutils-pop 3d_20020409-1woody2_i386.deb
Debian mailutils_20020409-1woody2_i386.deb
* Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/m/mailutils/mailutils_200 20409-1woody2_i386.deb
Debian Linux 3.0 mipsel
Debian libmailutils0-dev_20020409-1woody2_mipsel.deb
* Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/m/mailutils/libmailutils0 -dev_20020409-1woody2_mipsel.deb
Debian libmailutils0_20020409-1woody2_mipsel.deb
* Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/m/mailutils/libmailutils0 _20020409-1woody2_mipsel.deb
Debian mailutils-imap4d_20020409-1woody2_mipsel.deb
* Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/m/mailutils/mailutils-ima p4d_20020409-1woody2_mipsel.deb
Debian mailutils-pop3d_20020409-1woody2_mipsel.deb
* Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/m/mailutils/mailutils-pop 3d_20020409-1woody2_mipsel.deb
Debian mailutils_20020409-1woody2_mipsel.deb
* Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/m/mailutils/mailutils_200 20409-1woody2_mipsel.deb
Debian Linux 3.0 sparc
Debian libmailutils0-dev_20020409-1woody2_sparc.deb
* Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/m/mailutils/libmailutils0 -dev_20020409-1woody2_sparc.deb
Debian libmailutils0_20020409-1woody2_sparc.deb
* Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/m/mailutils/libmailutils0 _20020409-1woody2_sparc.deb
Debian mailutils-imap4d_20020409-1woody2_sparc.deb
* Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/m/mailutils/mailutils-ima p4d_20020409-1woody2_sparc.deb
Debian mailutils-pop3d_20020409-1woody2_sparc.deb
* Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/m/mailutils/mailutils-pop 3d_20020409-1woody2_sparc.deb
Debian mailutils_20020409-1woody2_sparc.deb
* Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/m/mailutils/mailutils_200 20409-1woody2_sparc.deb
Debian Linux 3.0 m68k
Debian libmailutils0-dev_20020409-1woody2_m68k.deb
* Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/m/mailutils/libmailutils0 -dev_20020409-1woody2_m68k.deb
Debian libmailutils0_20020409-1woody2_m68k.deb
* Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/m/mailutils/libmailutils0 _20020409-1woody2_m68k.deb
Debian mailutils-imap4d_20020409-1woody2_m68k.deb
* Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/m/mailutils/mailutils-ima p4d_20020409-1woody2_m68k.deb
Debian mailutils-pop3d_20020409-1woody2_m68k.deb
* Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/m/mailutils/mailutils-pop 3d_20020409-1woody2_m68k.deb
Debian mailutils_20020409-1woody2_m68k.deb
* Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/m/mailutils/mailutils_200 20409-1woody2_m68k.deb
Debian Linux 3.0 ia-64
Debian libmailutils0-dev_20020409-1woody2_ia64.deb
* Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/m/mailutils/libmailutils0 -dev_20020409-1woody2_ia64.deb
Debian libmailutils0_20020409-1woody2_ia64.deb
* Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/m/mailutils/libmailutils0 _20020409-1woody2_ia64.deb
Debian mailutils-imap4d_20020409-1woody2_ia64.deb
* Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/m/mailutils/mailutils-ima p4d_20020409-1woody2_ia64.deb
Debian mailutils-pop3d_20020409-1woody2_ia64.deb
* Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/m/mailutils/mailutils-pop 3d_20020409-1woody2_ia64.deb
Debian mailutils_20020409-1woody2_ia64.deb
* Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/m/mailutils/mailutils_200 20409-1woody2_ia64.deb

CVE References

CVE-2005-1523