spamGuard multiple buffer overflows
| spamguard-multiple-bo (16278) |  High Risk |
Description:
spamGuard is vulnerable to multiple buffer overflows in the qmail_parseline function and the sendmail_parseline function in the parser.c file and in the loadconfig function and the removespaces function in the loadconfig.c file. A remote attacker could exploit this vulnerability to overflow a buffer and execute arbitrary code on the system.
Platforms Affected:
- EnderUNIX, spamGuard prior to 1.7-BETA
Remedy:
Upgrade to the latest version of spamGuard (1.7-BETA or later), available from the spamGuard Web site. See References.
Consequences:
Gain Access
References:
- BugTraq Mailing List, Fri May 28 2004 - 18:02:48 CDT, EnderUNIX Security Anouncement (Isoqlog and Spamguard) at http://archives.neohapsis.com/archives/bugtraq/2004-05/0298.html.
- spamGuard Web site, EnderUNIX Software Development Team at http://www.enderunix.org/spamguard/.
- BID-10434: Spamguard Multiple Buffer Overflow Vulnerabilities
- CVE-2004-2429: Multiple stack-based and heap-based buffer overflows in EnderUNIX spamGuard before 1.7-BETA allow remote attackers to execute arbitrary code via the (1) qmail_parseline and (2) sendmail_parseline functions in parser.c, (3) loadconfig and (4) removespaces functions in loadconfig.c, and possibly (5) unspecified functions in functions.c.
- OSVDB ID: 6521: spamGuard parser.c Multiple Remote Overflows
- OSVDB ID: 6522: spamGuard loadconfig.c Multiple Overflows
- OSVDB ID: 6523: spamGuard functions.c Overflow
- SA11747: spamGuard Multiple Buffer Overflow Vulnerabilities
- SECTRACK ID: 1010342: spamGuard Multiple Buffer Overflows May Let Remote Users Execute Arbitrary Code
Reported:
May 28, 2004
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.
For corrections or additions please email xforce@iss.net