Rapid7 Vulnerability & Exploit Database

USN-725-1: KMail vulnerability

Free InsightVM Trial No credit card necessary
Watch Demo See how it all works
Back to Search

USN-725-1: KMail vulnerability

Severity
4
CVSS
(AV:L/AC:M/Au:N/C:P/I:P/A:P)
Published
02/26/2009
Created
07/25/2018
Added
02/26/2009
Modified
07/09/2020

Description

It was discovered that Kmail did not adequately prevent execution of arbitrarycode when a user clicked on a URL to an executable within an HTML mail. If auser clicked on a malicious URL and chose to execute the file, a remoteattacker could execute arbitrary code with user privileges. This update changesKMail's behavior to instead launch a helper program to view the file if theuser chooses to execute such a link. The problem can be corrected by updating your system to the following package version: To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades. After a standard system upgrade you need to restart KMail to effectthe necessary changes. LP: 332069

Solution(s)

  • ubuntu-upgrade-kmail

References

  • USN-725-1

insightVM

Advanced vulnerability management analytics and reporting.
Key Features
Free InsightVM Trial View All Features

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;