• info
• discussion
• exploit
• solution
• references

GNU Mailutils Imap4D Search Command Remote Format String Vulnerability

Solution:
The vendor has released a patch to address this issue. Please see the references for details.


GNU Mailutils 0.6

• GNU Mailutils-0.6 patch
  http://savannah.gnu.org/patch/download.php?item_id=4407&item_file_id=5 160

GNU Mailutils 0.6.1

• Debian libmailutils0-dev_0.6.1-4sarge1_alpha.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/libmailutils0 -dev_0.6.1-4sarge1_alpha.deb


• Debian libmailutils0-dev_0.6.1-4sarge1_amd64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/libmailutils0 -dev_0.6.1-4sarge1_amd64.deb


• Debian libmailutils0-dev_0.6.1-4sarge1_arm.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/libmailutils0 -dev_0.6.1-4sarge1_arm.deb


• Debian libmailutils0-dev_0.6.1-4sarge1_hppa.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/libmailutils0 -dev_0.6.1-4sarge1_hppa.deb


• Debian libmailutils0-dev_0.6.1-4sarge1_i386.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/libmailutils0 -dev_0.6.1-4sarge1_i386.deb


• Debian libmailutils0-dev_0.6.1-4sarge1_ia64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/libmailutils0 -dev_0.6.1-4sarge1_ia64.deb


• Debian libmailutils0-dev_0.6.1-4sarge1_m68k.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/libmailutils0 -dev_0.6.1-4sarge1_m68k.deb


• Debian libmailutils0-dev_0.6.1-4sarge1_mips.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/libmailutils0 -dev_0.6.1-4sarge1_mips.deb


• Debian libmailutils0-dev_0.6.1-4sarge1_mipsel.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/libmailutils0 -dev_0.6.1-4sarge1_mipsel.deb


• Debian libmailutils0-dev_0.6.1-4sarge1_powerpc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/libmailutils0 -dev_0.6.1-4sarge1_powerpc.deb


• Debian libmailutils0-dev_0.6.1-4sarge1_s390.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/libmailutils0 -dev_0.6.1-4sarge1_s390.deb


• Debian libmailutils0-dev_0.6.1-4sarge1_sparc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/libmailutils0 -dev_0.6.1-4sarge1_sparc.deb


• Debian libmailutils0_0.6.1-4sarge1_alpha.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/libmailutils0 _0.6.1-4sarge1_alpha.deb


• Debian libmailutils0_0.6.1-4sarge1_amd64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/libmailutils0 _0.6.1-4sarge1_amd64.deb


• Debian libmailutils0_0.6.1-4sarge1_arm.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/libmailutils0 _0.6.1-4sarge1_arm.deb


• Debian libmailutils0_0.6.1-4sarge1_hppa.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/libmailutils0 _0.6.1-4sarge1_hppa.deb


• Debian libmailutils0_0.6.1-4sarge1_i386.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/libmailutils0 _0.6.1-4sarge1_i386.deb


• Debian libmailutils0_0.6.1-4sarge1_ia64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/libmailutils0 _0.6.1-4sarge1_ia64.deb


• Debian libmailutils0_0.6.1-4sarge1_m68k.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/libmailutils0 _0.6.1-4sarge1_m68k.deb


• Debian libmailutils0_0.6.1-4sarge1_mips.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/libmailutils0 _0.6.1-4sarge1_mips.deb


• Debian libmailutils0_0.6.1-4sarge1_mipsel.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/libmailutils0 _0.6.1-4sarge1_mipsel.deb


• Debian libmailutils0_0.6.1-4sarge1_powerpc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/libmailutils0 _0.6.1-4sarge1_powerpc.deb


• Debian libmailutils0_0.6.1-4sarge1_s390.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/libmailutils0 _0.6.1-4sarge1_s390.deb


• Debian libmailutils0_0.6.1-4sarge1_sparc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/libmailutils0 _0.6.1-4sarge1_sparc.deb


• Debian mailutils-comsatd_0.6.1-4sarge1_alpha.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils-com satd_0.6.1-4sarge1_alpha.deb


• Debian mailutils-comsatd_0.6.1-4sarge1_amd64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils-com satd_0.6.1-4sarge1_amd64.deb


• Debian mailutils-comsatd_0.6.1-4sarge1_arm.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils-com satd_0.6.1-4sarge1_arm.deb


• Debian mailutils-comsatd_0.6.1-4sarge1_hppa.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils-com satd_0.6.1-4sarge1_hppa.deb


• Debian mailutils-comsatd_0.6.1-4sarge1_i386.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils-com satd_0.6.1-4sarge1_i386.deb


• Debian mailutils-comsatd_0.6.1-4sarge1_ia64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils-com satd_0.6.1-4sarge1_ia64.deb


• Debian mailutils-comsatd_0.6.1-4sarge1_m68k.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils-com satd_0.6.1-4sarge1_m68k.deb


• Debian mailutils-comsatd_0.6.1-4sarge1_mips.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils-com satd_0.6.1-4sarge1_mips.deb


• Debian mailutils-comsatd_0.6.1-4sarge1_mipsel.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils-com satd_0.6.1-4sarge1_mipsel.deb


• Debian mailutils-comsatd_0.6.1-4sarge1_powerpc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils-com satd_0.6.1-4sarge1_powerpc.deb


• Debian mailutils-comsatd_0.6.1-4sarge1_s390.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils-com satd_0.6.1-4sarge1_s390.deb


• Debian mailutils-comsatd_0.6.1-4sarge1_sparc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils-com satd_0.6.1-4sarge1_sparc.deb


• Debian mailutils-doc_0.6.1-4sarge1_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils-doc _0.6.1-4sarge1_all.deb


• Debian mailutils-imap4d_0.6.1-4sarge1_alpha.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils-ima p4d_0.6.1-4sarge1_alpha.deb


• Debian mailutils-imap4d_0.6.1-4sarge1_amd64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils-ima p4d_0.6.1-4sarge1_amd64.deb


• Debian mailutils-imap4d_0.6.1-4sarge1_arm.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils-ima p4d_0.6.1-4sarge1_arm.deb


• Debian mailutils-imap4d_0.6.1-4sarge1_hppa.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils-ima p4d_0.6.1-4sarge1_hppa.deb


• Debian mailutils-imap4d_0.6.1-4sarge1_i386.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils-ima p4d_0.6.1-4sarge1_i386.deb


• Debian mailutils-imap4d_0.6.1-4sarge1_ia64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils-ima p4d_0.6.1-4sarge1_ia64.deb


• Debian mailutils-imap4d_0.6.1-4sarge1_m68k.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils-ima p4d_0.6.1-4sarge1_m68k.deb


• Debian mailutils-imap4d_0.6.1-4sarge1_mips.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils-ima p4d_0.6.1-4sarge1_mips.deb


• Debian mailutils-imap4d_0.6.1-4sarge1_mipsel.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils-ima p4d_0.6.1-4sarge1_mipsel.deb


• Debian mailutils-imap4d_0.6.1-4sarge1_powerpc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils-ima p4d_0.6.1-4sarge1_powerpc.deb


• Debian mailutils-imap4d_0.6.1-4sarge1_s390.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils-ima p4d_0.6.1-4sarge1_s390.deb


• Debian mailutils-imap4d_0.6.1-4sarge1_sparc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils-ima p4d_0.6.1-4sarge1_sparc.deb


• Debian mailutils-mh_0.6.1-4sarge1_alpha.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils-mh_ 0.6.1-4sarge1_alpha.deb


• Debian mailutils-mh_0.6.1-4sarge1_amd64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils-mh_ 0.6.1-4sarge1_amd64.deb


• Debian mailutils-mh_0.6.1-4sarge1_arm.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils-mh_ 0.6.1-4sarge1_arm.deb


• Debian mailutils-mh_0.6.1-4sarge1_hppa.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils-mh_ 0.6.1-4sarge1_hppa.deb


• Debian mailutils-mh_0.6.1-4sarge1_i386.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils-mh_ 0.6.1-4sarge1_i386.deb


• Debian mailutils-mh_0.6.1-4sarge1_ia64.de
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils-mh_ 0.6.1-4sarge1_ia64.deb


• Debian mailutils-mh_0.6.1-4sarge1_m68k.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils-mh_ 0.6.1-4sarge1_m68k.deb


• Debian mailutils-mh_0.6.1-4sarge1_mips.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils-mh_ 0.6.1-4sarge1_mips.deb


• Debian mailutils-mh_0.6.1-4sarge1_mipsel.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils-mh_ 0.6.1-4sarge1_mipsel.deb


• Debian mailutils-mh_0.6.1-4sarge1_powerpc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils-mh_ 0.6.1-4sarge1_powerpc.deb


• Debian mailutils-mh_0.6.1-4sarge1_s390.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils-mh_ 0.6.1-4sarge1_s390.deb


• Debian mailutils-mh_0.6.1-4sarge1_sparc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils-mh_ 0.6.1-4sarge1_sparc.deb


• Debian mailutils-pop3d_0.6.1-4sarge1_alpha.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils-pop 3d_0.6.1-4sarge1_alpha.deb


• Debian mailutils-pop3d_0.6.1-4sarge1_amd64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils-pop 3d_0.6.1-4sarge1_amd64.deb


• Debian mailutils-pop3d_0.6.1-4sarge1_arm.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils-pop 3d_0.6.1-4sarge1_arm.deb


• Debian mailutils-pop3d_0.6.1-4sarge1_hppa.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils-pop 3d_0.6.1-4sarge1_hppa.deb


• Debian mailutils-pop3d_0.6.1-4sarge1_i386.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils-pop 3d_0.6.1-4sarge1_i386.deb


• Debian mailutils-pop3d_0.6.1-4sarge1_ia64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils-pop 3d_0.6.1-4sarge1_ia64.deb


• Debian mailutils-pop3d_0.6.1-4sarge1_m68k.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils-pop 3d_0.6.1-4sarge1_m68k.deb


• Debian mailutils-pop3d_0.6.1-4sarge1_mips.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils-pop 3d_0.6.1-4sarge1_mips.deb


• Debian mailutils-pop3d_0.6.1-4sarge1_mipsel.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils-pop 3d_0.6.1-4sarge1_mipsel.deb


• Debian mailutils-pop3d_0.6.1-4sarge1_powerpc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils-pop 3d_0.6.1-4sarge1_powerpc.deb


• Debian mailutils-pop3d_0.6.1-4sarge1_s390.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils-pop 3d_0.6.1-4sarge1_s390.deb


• Debian mailutils-pop3d_0.6.1-4sarge1_sparc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils-pop 3d_0.6.1-4sarge1_sparc.deb


• Debian mailutils_0.6.1-4sarge1_alpha.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils_0.6 .1-4sarge1_alpha.deb


• Debian mailutils_0.6.1-4sarge1_amd64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils_0.6 .1-4sarge1_amd64.deb


• Debian mailutils_0.6.1-4sarge1_arm.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils_0.6 .1-4sarge1_arm.deb


• Debian mailutils_0.6.1-4sarge1_hppa.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils_0.6 .1-4sarge1_hppa.deb


• Debian mailutils_0.6.1-4sarge1_i386.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils_0.6 .1-4sarge1_i386.deb


• Debian mailutils_0.6.1-4sarge1_ia64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils_0.6 .1-4sarge1_ia64.deb


• Debian mailutils_0.6.1-4sarge1_m68k.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils_0.6 .1-4sarge1_m68k.deb


• Debian mailutils_0.6.1-4sarge1_mips.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils_0.6 .1-4sarge1_mips.deb


• Debian mailutils_0.6.1-4sarge1_mipsel.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils_0.6 .1-4sarge1_mipsel.deb


• Debian mailutils_0.6.1-4sarge1_powerpc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils_0.6 .1-4sarge1_powerpc.deb


• Debian mailutils_0.6.1-4sarge1_s390.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils_0.6 .1-4sarge1_s390.deb


• Debian mailutils_0.6.1-4sarge1_sparc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/m/mailutils/mailutils_0.6 .1-4sarge1_sparc.deb