QMail-QMTPD RELAYCLIENT Environment Variable Integer Overflow Vulnerability

An integer overflow vulnerability has been reported in qmail-qmtpd. This issue exists in code that processes values supplied to qmail-qmtpd in RELAYCLIENT data. Though unconfirmed, this issue may be exploitable to execute arbitrary code with elevated privileges.

It should be noted that this issue does not exist in the default configuration and is only exposed if mail relaying is enabled by setting the RELAYCLIENT environment variable.


Privacy Statement
Copyright 2010, SecurityFocus