The pop_msg function in qpopper 4.0.x before 4.0.5fc2 does not null terminate a message buffer after a call to Qvsnprintf, which could allow authenticated users to execute arbitrary code via a buffer overflow in a mdef command with a long macro name.

Florian Heinz posted to the Bugtraq mailing list an exploit for qpopper based on a bug in the included vsnprintf implementation. The sample exploit requires a valid user account and password, and overflows a string in the pop_msg() function to give the user 'mail' group privileges and a shell on the system. Since the Qvsnprintf function is used elsewhere in qpopper, additional exploits may be possible.

The qpopper package in Debian 2.2 (potato) does not include the vulnerable snprintf implementation. For Debian 3.0 (woody) an updated package is available in version 4.0.4-2.woody.3. Users running an unreleased version of Debian should upgrade to 4.0.4-9 or newer. We recommend you upgrade your qpopper package immediately.

The remote qpopper server, according to its banner, is vulnerable to a one-byte overflow in the function Qvsnprintf(). An attacker may use this flaw to gain a (non-root) shell on this host, provided that the attacker has a valid POP account to log in with.

The remote host is missing the patch for the advisory SUSE-SA:2003:018 (qpopper).


The Post-Office-Protocol- (POP-) Server qpopper (version 4) was vulnerable to a buffer overflow. The buffer overflow occurs after authentication has taken place. Therefore pop-users with a valid account can execute arbitrary code on the system running qpopper.
Depending on the setup, the malicious code is run with higher privileges.

There is no temporary fix known, please update your system.

Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement.
Then, install the package using the command 'rpm -Fhv file.rpm' to apply the update.

The remote Qpopper server, according to its banner, is vulnerable to a one-byte overflow ih its pop_msg function after a call to Qvsnprintf(). 

An attacker may use this flaw to execute code with the privileges of the Qpopper service (usually non-root), provided that he has a valid POP account to log in with.

*** This test could not confirm the existence of the
*** problem - it relied on the banner being returned.

ID	Name	Product	Family	Severity
15096	Debian DSA-259-1 : qpopper - mail user privilege escalation	Nessus	Debian Local Security Checks	critical
1786	qpopper < 4.0.5fc2 Qvsnprintf Remote Overflow	Nessus Network Monitor	POP Server	medium
13788	SUSE-SA:2003:018: qpopper	Nessus	SuSE Local Security Checks	critical
11376	Qpopper pop_msg() Macroname Remote Overflow	Nessus	Misc.	medium

Detections

Analytics

CVE-2003-0143

high

Tenable Plugins

critical

medium

critical

medium