RELiC
Apr 28 2004, 06:19 AM
Multiple Vulnerabilities in ssmtp
| CODE |
Multiple Vulnerabilities in ssmtp
Synopsis
========
There are multiple format string vulnerabilities in the SSMTP package,which may allow an attacker to run arbitrary code with ssmtp's privileges (potentially root).
Background
==========
SSMTP is a very simple mail transfer agent (MTA) that relays mail from the local machine to another SMTP host. It is not designed to function as a full mail server; its sole purpose is to relay mail.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-mail/ssmtp <= 2.60.4-r2 >= 2.60.7
Description
===========
There are two format string vulnerabilities inside the log_event() and die() functions of ssmtp. Strings from outside ssmtp are passed to various printf()-like functions from within log_event() and die() as
format strings. An attacker could cause a specially-crafted string to be passed to these functions, and potentially cause ssmtp to execute arbitrary code.
Impact
======
If ssmtp connects to a malicious mail relay server, this vulnerability can be used to execute code with the rights of the mail sender, including root.
Workaround
==========
There is no known workaround at this time. All users are advised to upgrade to the latest available version of ssmtp.
Resolution
==========
All users are advised to upgrade to the latest available version of ssmtp.
# emerge sync
# emerge -pv ">=net-mail/ssmtp-2.60.7"
# emerge ">=net-mail/ssmtp-2.60.7"
References
==========
[ 1 ] Secunia Advisory: http://secunia.com/advisories/11378/
[ 2 ] CVE Reference: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0156
[ 3 ] Debian Advisory:http://lists.debian.org/debian-security-announce/debian-security-announce-2004/msg00084.html |
../
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please
click here.
