Summary
The remote host is missing an update to qpopper
announced via advisory DSA 728-1.
Solution
https://secure1.securityspace.com/smysecure/catid.html?in=DSA%20728-1
Insight
Two bugs have been discovered in qpopper, an enhanced Post Office Protocol (POP3) server. The Common Vulnerability and Exposures project identifies the following problems:
CVE-2005-1151
Jens Steube discovered that while processing local files owned or provided by a normal user privileges weren't dropped, which could lead to the overwriting or creation of arbitrary files as root.
CVE-2005-1152
The upstream developers noticed that qpopper could be tricked to creating group- or world-writable files.
For the stable distribution (woody) these problems have been fixed in version 4.0.4-2.woody.5.
For the testing distribution (sarge) these problems have been fixed in version 4.0.5-4sarge1.
For the unstable distribution (sid) these problems will be fixed in version 4.0.5-4sarge1.
We recommend that you upgrade your qpopper package.
Severity
Classification
-
CVE CVE-2005-1151, CVE-2005-1152 -
CVSS Base Score: 7.2
AV:L/AC:L/Au:N/C:C/I:C/A:C
Related Vulnerabilities