Max Vozeler discovered several format string vulnerabilities in the movemail utility of Emacs, the well-known editor. Via connecting to a malicious POP server an attacker can execute arbitrary code under the privileges of group mail.

Max Vozeler discovered several format string vulnerabilities in the movemail utility in Emacs. If a user connects to a malicious POP server, an attacker can execute arbitrary code as the user running emacs.

The updated packages have been patched to correct the problem.

Updated Emacs packages that fix a string format issue are now available.

Emacs is a powerful, customizable, self-documenting, modeless text editor.

Max Vozeler discovered several format string vulnerabilities in the movemail utility of Emacs. If a user connects to a malicious POP server, an attacker can execute arbitrary code as the user running emacs. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0100 to this issue.

Users of Emacs are advised to upgrade to these updated packages, which contain backported patches to correct this issue.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2005:110 advisory.

  - security flaw (CVE-2005-0100)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2005:133 advisory.

  - security flaw (CVE-2005-0100)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Max Vozeler discovered a format string vulnerability in the 'movemail' utility of Emacs. By sending specially crafted packets, a malicious POP3 server could cause a buffer overflow, which could have been exploited to execute arbitrary code with the privileges of the user and the 'mail' group (since 'movemail' is installed as 'setgid mail').

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200502-20 (Emacs, XEmacs: Format string vulnerabilities in movemail)

    Max Vozeler discovered that the movemail utility contains several     format string errors.
  Impact :

    An attacker could set up a malicious POP server and entice a user to     connect to it using movemail, resulting in the execution of arbitrary     code with the rights of the victim user.
  Workaround :

    There is no known workaround at this time.

Max Vozeler discovered several format string vulnerabilities in the movemail utility of Emacs. They can be exploited when connecting to a malicious POP server and can allow an attacker can execute arbitrary code under the privileges of the user running Emacs.

Updated XEmacs packages that fix a string format issue are now available.

XEmacs is a powerful, customizable, self-documenting, modeless text editor.

Max Vozeler discovered several format string vulnerabilities in the movemail utility of XEmacs. If a user connects to a malicious POP server, an attacker can execute arbitrary code as the user running xemacs. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0100 to this issue.

Users of XEmacs are advised to upgrade to these updated packages, which contain backported patches to correct this issue.

ID	名稱	產品	系列	已發布	已更新	嚴重性
16344	Debian DSA-670-1 : emacs20 - format string	Nessus	Debian Local Security Checks	2005/2/10	2021/1/4	high
17130	Debian DSA-685-1 : emacs21 - format string	Nessus	Debian Local Security Checks	2005/2/17	2021/1/4	high
16473	Mandrake Linux Security Advisory : emacs (MDKSA-2005:038)	Nessus	Mandriva Local Security Checks	2005/2/16	2021/1/6	high
16345	Debian DSA-671-1 : xemacs21 - format string	Nessus	Debian Local Security Checks	2005/2/10	2021/1/4	high
16368	RHEL 2.1 / 3 : emacs (RHSA-2005:112)	Nessus	Red Hat Local Security Checks	2005/2/10	2021/1/14	high
17189	RHEL 4 : emacs (RHSA-2005:110)	Nessus	Red Hat Local Security Checks	2005/2/22	2024/4/27	critical
17190	RHEL 4 : xemacs (RHSA-2005:133)	Nessus	Red Hat Local Security Checks	2005/2/22	2024/4/27	critical
20698	Ubuntu 4.10 : emacs21 vulnerability (USN-76-1)	Nessus	Ubuntu Local Security Checks	2006/1/15	2021/1/19	high
16471	GLSA-200502-20 : Emacs, XEmacs: Format string vulnerabilities in movemail	Nessus	Gentoo Local Security Checks	2005/2/16	2021/1/6	high
18910	FreeBSD : emacs -- movemail format string vulnerability (3e3c860d-7dae-11d9-a9e7-0001020eed82)	Nessus	FreeBSD Local Security Checks	2005/7/13	2021/1/6	high
16369	RHEL 2.1 / 3 : xemacs (RHSA-2005:134)	Nessus	Red Hat Local Security Checks	2005/2/10	2021/1/14	high

偵測

搜尋 Plugin

high

high

high

high

high

critical

critical

high

high

high

high