Executive Summary
| Informations | |||
|---|---|---|---|
| Name | CVE-2014-3618 | First vendor Publication | 2014-09-08 |
| Vendor | Cve | Last vendor Modification | 2024-11-21 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 7.5 | Attack Range | Network |
| Cvss Impact Score | 6.4 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Heap-based buffer overflow in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted email header, related to "unbalanced quotes." |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3618 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:25929 | |||
| Oval ID: | oval:org.mitre.oval:def:25929 | ||
| Title: | USN-2340-1 -- procmail vulnerability | ||
| Description: | formail could be made to crash or run programs if it processed specially crafted mail. | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-2340-1 CVE-2014-3618 | Version: | 3 |
| Platform(s): | Ubuntu 14.04 Ubuntu 12.04 Ubuntu 10.04 | Product(s): | procmail |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:26477 | |||
| Oval ID: | oval:org.mitre.oval:def:26477 | ||
| Title: | RHSA-2014:1172: procmail security update (Important) | ||
| Description: | The procmail program is used for local mail delivery. In addition to just delivering mail, procmail can be used for automatic filtering, presorting, and other mail handling jobs. A heap-based buffer overflow flaw was found in procmail's formail utility. A remote attacker could send an email with specially crafted headers that, when processed by formail, could cause procmail to crash or, possibly, execute arbitrary code as the user running formail. (CVE-2014-3618) All procmail users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. | ||
| Family: | unix | Class: | patch |
| Reference(s): | RHSA-2014:1172-00 CESA-2014:1172 CVE-2014-3618 | Version: | 3 |
| Platform(s): | Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 5 CentOS Linux 5 CentOS Linux 6 CentOS Linux 7 | Product(s): | procmail |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:26698 | |||
| Oval ID: | oval:org.mitre.oval:def:26698 | ||
| Title: | DSA-3019-1 procmail - security update | ||
| Description: | It was reported a heap overflow vulnerability in procmail's formail utility when processing specially-crafted email headers. A remote attacker could use this flaw to cause formail to crash, resulting in a denial of service or data loss, or possibly execute arbitrary code. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-3019-1 CVE-2014-3618 | Version: | 3 |
| Platform(s): | Debian GNU/Linux 7.0 Debian GNU/kFreeBSD 7.0 | Product(s): | procmail |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:26760 | |||
| Oval ID: | oval:org.mitre.oval:def:26760 | ||
| Title: | ELSA-2014-1172 -- procmail security update (Important) | ||
| Description: | The procmail program is used for local mail delivery. In addition to just delivering mail, procmail can be used for automatic filtering, presorting, and other mail handling jobs. A heap-based buffer overflow flaw was found in procmail's formail utility. A remote attacker could send an email with specially crafted headers that, when processed by formail, could cause procmail to crash or, possibly, execute arbitrary code as the user running formail. (CVE-2014-3618) All procmail users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2014-1172 CVE-2014-3618 | Version: | 3 |
| Platform(s): | Oracle Linux 7 Oracle Linux 6 Oracle Linux 5 | Product(s): | procmail |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:26761 | |||
| Oval ID: | oval:org.mitre.oval:def:26761 | ||
| Title: | SUSE-SU-2014:1137-1 -- Security update for procmail | ||
| Description: | ocmail was updated to fix a security issue in its formail helper. * When formail processed specially crafted e-mail headers a heap corruption could be triggered, which would lead to a crash of formail. (CVE-2014-3618) Security Issues: * CVE-2014-3618 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3618> | ||
| Family: | unix | Class: | patch |
| Reference(s): | SUSE-SU-2014:1137-1 CVE-2014-3618 | Version: | 3 |
| Platform(s): | SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Desktop 11 | Product(s): | procmail |
| Definition Synopsis: | |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 1 | |
| Os | 3 |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2017-12-08 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2017-3231-1.nasl - Type : ACT_GATHER_INFO |
| 2015-10-05 | Name : The remote host is missing a Mac OS X update that fixes multiple security vul... File : macosx_10_11.nasl - Type : ACT_GATHER_INFO |
| 2015-03-26 | Name : The remote Debian host is missing a security update. File : debian_DLA-46.nasl - Type : ACT_GATHER_INFO |
| 2015-01-19 | Name : The remote Solaris system is missing a security patch for third-party software. File : solaris11_procmail_20141014.nasl - Type : ACT_GATHER_INFO |
| 2014-10-12 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2014-408.nasl - Type : ACT_GATHER_INFO |
| 2014-09-26 | Name : The remote Fedora host is missing a security update. File : fedora_2014-10359.nasl - Type : ACT_GATHER_INFO |
| 2014-09-23 | Name : The remote Fedora host is missing a security update. File : fedora_2014-10142.nasl - Type : ACT_GATHER_INFO |
| 2014-09-17 | Name : The remote SuSE 11 host is missing a security update. File : suse_11_procmail-140904.nasl - Type : ACT_GATHER_INFO |
| 2014-09-15 | Name : The remote Fedora host is missing a security update. File : fedora_2014-10357.nasl - Type : ACT_GATHER_INFO |
| 2014-09-12 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2014-537.nasl - Type : ACT_GATHER_INFO |
| 2014-09-11 | Name : The remote CentOS host is missing a security update. File : centos_RHSA-2014-1172.nasl - Type : ACT_GATHER_INFO |
| 2014-09-11 | Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2014-1172.nasl - Type : ACT_GATHER_INFO |
| 2014-09-11 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2014-1172.nasl - Type : ACT_GATHER_INFO |
| 2014-09-11 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20140910_procmail_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
| 2014-09-05 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-3019.nasl - Type : ACT_GATHER_INFO |
| 2014-09-05 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-2340-1.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2024-11-28 12:40:59 |
|
| 2023-02-13 05:28:18 |
|
| 2023-02-03 00:28:33 |
|
| 2021-05-04 12:33:01 |
|
| 2021-04-22 01:39:29 |
|
| 2020-05-23 00:41:08 |
|
| 2017-12-09 13:24:14 |
|
| 2017-08-29 09:24:35 |
|
| 2017-01-07 09:25:36 |
|
| 2016-04-27 00:53:10 |
|
| 2015-10-10 09:22:53 |
|
| 2015-10-07 13:24:24 |
|
| 2015-03-27 13:28:16 |
|
| 2015-01-21 13:26:56 |
|
| 2014-11-14 13:28:06 |
|
| 2014-10-17 13:26:22 |
|
| 2014-10-12 13:27:23 |
|
| 2014-09-26 13:27:28 |
|
| 2014-09-24 13:28:15 |
|
| 2014-09-18 13:27:21 |
|
| 2014-09-16 13:26:28 |
|
| 2014-09-13 13:43:07 |
|
| 2014-09-12 21:27:42 |
|
| 2014-09-12 13:27:17 |
|
| 2014-09-09 21:24:30 |
|
| 2014-09-08 21:23:41 |
|
