VULHUB ™

There are three buffer overflow vulnerabilities in the CDE mail utilities, all of which are installed sgid mail by default. The first is exploited through overrunning a buffer in the Content-Type: field, which would look something like this: Content-Type: image/aaaaaaaa long 'a' aaaaaa; name="test.gif" mailtool will overflow when email is selected which has a content-type field like that. It may be possible for an attacker to obtain root priviliges if shellcode is written appropriately and root selects the malicious email message. The second vulnerability is in dtmail, which will crash (and possibly execute arbitrary code) if a long paramater is passed argumenting the -f command-line option. The third is in mailpr, which is vulnerable to a long -f paramater as well. The most basic consequence of these being exploited is a compromise of local email, since all mail data is set mode 660, read and write permissions granted for members of group mail. As of November 30, 1999, Solaris 7...

There are three buffer overflow vulnerabilities in the CDE mail utilities, all of which are installed sgid mail by default. The first is exploited through overrunning a buffer in the Content-Type: field, which would look something like this: Content-Type: image/aaaaaaaa long 'a' aaaaaa; name="test.gif" mailtool will overflow when email is selected which has a content-type field like that. It may be possible for an attacker to obtain root priviliges if shellcode is written appropriately and root selects the malicious email message. The second vulnerability is in dtmail, which will crash (and possibly execute arbitrary code) if a long paramater is passed argumenting the -f command-line option. The third is in mailpr, which is vulnerable to a long -f paramater as well. The most basic consequence of these being exploited is a compromise of local email, since all mail data is set mode 660, read and write permissions granted for members of group mail. As of November 30, 1999, Solaris 7 is the only known vulnerable platform.