VULHUB ™

A vulnerability exist in the vpopmail package from Inter7. vpopmail is a popular POP3 server for users using the qmail package for handling receipt of SMTP mail. Versions prior to 4.8 of vpopmail were susceptible to a vulnerability where vchkpw, the portion of vpopmail which performs authentication, incorrectly allows the use of user supplied data as a format string to a vsprintf() call. By placing certain conversion specifications in the string, it becomes possible to overwrite values on the stack. This in turn could be used to execute arbitrary code with the permissions of the program being run.

A vulnerability exist in the vpopmail package from Inter7. vpopmail is a popular POP3 server for users using the qmail package for handling receipt of SMTP mail. Versions prior to 4.8 of vpopmail were susceptible to a vulnerability where vchkpw, the portion of vpopmail which performs authentication, incorrectly allows the use of user supplied data as a format string to a vsprintf() call. By placing certain conversion specifications in the string, it becomes possible to overwrite values on the stack. This in turn could be used to execute arbitrary code with the permissions of the program being run.