Test ID:	1.3.6.1.4.1.25623.1.0.53590
Category:	Debian Local Security Checks
Title:	Debian: Security Advisory (DSA-259)
Summary:	The remote host is missing an update for the Debian 'qpopper' package(s) announced via the DSA-259 advisory.
Description:	Summary: The remote host is missing an update for the Debian 'qpopper' package(s) announced via the DSA-259 advisory. Vulnerability Insight: Florian Heinz posted to the Bugtraq mailing list an exploit for qpopper based on a bug in the included vsnprintf implementation. The sample exploit requires a valid user account and password, and overflows a string in the pop_msg() function to give the user 'mail' group privileges and a shell on the system. Since the Qvsnprintf function is used elsewhere in qpopper, additional exploits may be possible. The qpopper package in Debian 2.2 (potato) does not include the vulnerable snprintf implementation. For Debian 3.0 (woody) an updated package is available in version 4.0.4-2.woody.3. Users running an unreleased version of Debian should upgrade to 4.0.4-9 or newer. We recommend you upgrade your qpopper package immediately. Affected Software/OS: 'qpopper' package(s) on Debian 3.0. Solution: Please install the updated package(s). CVSS Score: 10.0 CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2003-0143 BugTraq ID: 7058 http://www.securityfocus.com/bid/7058 Bugtraq: 20030310 QPopper 4.0.x buffer overflow vulnerability (Google Search) http://marc.info/?l=bugtraq&m=104739841223916&w=2 Bugtraq: 20030312 Re: QPopper 4.0.x buffer overflow vulnerability (Google Search) http://marc.info/?l=bugtraq&m=104748775900481&w=2 Bugtraq: 20030314 [OpenPKG-SA-2003.018] OpenPKG Security Advisory (qpopper) (Google Search) http://marc.info/?l=bugtraq&m=104768137314397&w=2 Debian Security Information: DSA-259 (Google Search) http://www.debian.org/security/2003/dsa-259 http://marc.info/?l=bugtraq&m=104792541215354&w=2 SuSE Security Announcement: SuSE-SA:2003:018 (Google Search) http://www.novell.com/linux/security/advisories/2003_018_qpopper.html XForce ISS Database: qpopper-popmsg-macroname-bo(11516) https://exchange.xforce.ibmcloud.com/vulnerabilities/11516
Copyright	Copyright (C) 2008 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.