Symantec Mail Security Buffer Overflows in Autonomy KeyView Module Let Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1019805
|
|
SecurityTracker URL: http://securitytracker.com/id?1019805
|
|
CVE Reference: CVE-2007-5405
, CVE-2007-5406
, CVE-2007-6020
(Links to External Site)
|
Updated: Apr 17 2008
|
Original Entry Date: Apr 8 2008
|
Impact: Execution of arbitrary code via network, User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Advisory: Symantec Advisory
|
Description: A vulnerability was reported in Symantec Mail Security. A remote user can execute arbitrary code on the target system.
A remote user can send a specially crafted e-mail attachment to trigger a buffer overflow and execute arbitrary code on the target
system. The code will run with the privileges of the target service.
On the SMS for SMTP and SMS Appliance, the overflow will
result in a child process crash.
The vulnerability resides in the third party Autonomy KeyView module.
Secunia reported this
vulnerability.
|
Impact: A remote user can execute arbitrary code on the target system.
|
Solution: The vendor has issued the following fixes.
Symantec Mail Security for Domino 7.5: 7.5.3.25
Symantec Mail Security for Microsoft
Exchange 5.0: Upgrade in Progress
Symantec Mail Security for SMTP 5.0.0: Upgrade to 5.0.1 patch level 189
Symantec Mail Security
Appliance 5.0.x: Update to 5.0.0-36 or later
The vendor's advisory is available at:
http://securityresponse.symantec.com/avcenter/security/Content/2008.04.08e.html
|
Vendor URL: securityresponse.symantec.com/avcenter/security/Content/2008.04.08e.html (Links to External Site)
|
Cause: Boundary error
|
Underlying OS: Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Tue, 8 Apr 2008 18:21:13 -0400
Subject: Symantec Mail Security Autonomy KeyView Module Vulnerability
|
http://securityresponse.symantec.com/avcenter/security/Content/2008.04.08e.html
|
|
