PT-2003-1342 · Hypermail · Hypermail

Ulf Harnhammar · Published 2003-02-01 · Updated 2017-07-11 · CVE-2003-0057

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Hypermail versions prior to 2.1.6

Description The issue is related to multiple buffer overflows that can be triggered by remote attackers. This can be achieved in two ways: (1) by using a long attachment filename that is not properly handled by the hypermail executable, or (2) by connecting to the mail CGI program from an IP address that reverse-resolves to a long hostname. This can cause a denial of service and possibly allow the execution of arbitrary code.

Recommendations For versions prior to 2.1.6, update to version 2.1.6 or later to resolve the issue.

Fix

Related Identifiers

CVE-2003-0057

DSA-248

Affected Products

Hypermail

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2003-0057 · Security Note
• http://debian.org/security/2003/dsa-248 · Vendor Advisory
• http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0042.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/11158 · Note
• http://securityfocus.com/bid/6690 · Note
• http://secunia.com/advisories/8030 · Note
• http://marc.info/?l=bugtraq&m=104369136703903&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/11157 · Note
• http://securityfocus.com/bid/6689 · Note