SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker
bugs
@
securitytracker.com






Category:   Application (E-mail Client)  >   Mutt Vendors:   Mutt.org
Mutt E-mail Client Buffer Overflow May Let Remote Users Cause Arbitary Commands to Be Executed on the Mutt User's Host
SecurityTracker Alert ID:  1003085
SecurityTracker URL:  http://securitytracker.com/id/1003085
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Updated:  Jan 2 2002
Original Entry Date:  Jan 2 2002
Impact:   Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): mutt-1.2.5 and 1.3.24 and prior releases
Description:   A buffer overflow vulnerability was reported in the Mutt e-mail client that may allow remote users to cause arbitrary commands to be executed by another user's Mutt e-mail client.

It is reported that this vulnerability is remotely exploitable. The bug is apparently due to a one byte buffer overflow. No other details on the vulnerability were provided.

Impact:   A remote user may be able to create an e-mail message that, when viewed by another user with the Mutt client, will cause arbitrary commands to be executed by the Mutt client with the privileges of the user running Mutt.
Solution:   mutt-1.2.5.1 and mutt-1.3.25 have been released to correct the problem. They are available at the Vendor URL or http://www.mutt.org/
Vendor URL:  www.mutt.org/announce/mutt-1.2.5.1-1.3.25.html (Links to External Site)
Cause:   Boundary error
Underlying OS:   Linux (Any), UNIX (Any)

Message History:   This archive entry has one or more follow-up message(s) listed below.
(Debian Issues Fix) Mutt E-mail Client Buffer Overflow May Let Remote Users Cause Arbitary Commands to Be Executed on the Mutt User's Host   (Wichert Akkerman <wichert@wiggy.net>)
The vendor has released a fix.
(Debian Issues Fix for Sparc Platform) Mutt E-mail Client Buffer Overflow May Let Remote Users Cause Arbitary Commands to Be Executed on the Mutt User's Host   (Wichert Akkerman <wichert@wiggy.net>)
The vendor has released a fix for the Sparc platform.
(FreeBSD Issues Fix) Mutt E-mail Client Buffer Overflow May Let Remote Users Cause Arbitary Commands to Be Executed on the Mutt User's Host   (FreeBSD Security Advisories <security-advisories@FreeBSD.ORG>)
The vendor has released a fix.
(Trustix Issues Fix) Mutt E-mail Client Buffer Overflow May Let Remote Users Cause Arbitary Commands to Be Executed on the Mutt User's Host   (Trustix Secure Linux Advisor <tsl@trustix.com>)
The vendor has released a fix.
(Conectiva Issues Fix) Mutt E-mail Client Buffer Overflow May Let Remote Users Cause Arbitary Commands to Be Executed on the Mutt User's Host   (secure@conectiva.com.br)
The vendor has released a fix.
(SuSE Issues Fix) Mutt E-mail Client Buffer Overflow May Let Remote Users Cause Arbitary Commands to Be Executed on the Mutt User's Host   (Roman Drahtmueller <draht@suse.de>)
The vendor has released a fix.
(Red Hat Issues Fix) Re: Mutt E-mail Client Buffer Overflow May Let Remote Users Cause Arbitary Commands to Be Executed on the Mutt User's Host   (bugzilla@redhat.com)
Red Hat has issued a fix.
(Slackware Issues Fix) Re: Mutt E-mail Client Buffer Overflow May Let Remote Users Cause Arbitary Commands to Be Executed on the Mutt User's Host   (Slackware Security Team <security@slackware.com>)
Slackware Linux has issued a fix.
(Mandrake Issues Fix) Mutt E-mail Client Buffer Overflow May Let Remote Users Cause Arbitary Commands to Be Executed on the Mutt User's Host   (Mandrake Linux Security Team <security@linux-mandrake.com>)
The vendor has released a fix.
(HP Issues Fix for Linux) Mutt E-mail Client Buffer Overflow May Let Remote Users Cause Arbitary Commands to Be Executed on the Mutt User's Host   (support_feedback@us-support.external.hp.com (IT Resource Center ))
The vendor has released a fix for HP Secure OS for Linux.
(Mandrake Issues Revised Fix) Mutt E-mail Client Buffer Overflow May Let Remote Users Cause Arbitary Commands to Be Executed on the Mutt User's Host   (Mandrake Linux Security Team <security@linux-mandrake.com>)
The vendor has released a revised fix.
(Caldera Issues Fix) Mutt E-mail Client Buffer Overflow May Let Remote Users Cause Arbitary Commands to Be Executed on the Mutt User's Host   (Support Info <supinfo@caldera.com>)
The vendor has released a fix.



 Source Message Contents

Date:  Tue, 1 Jan 2002 21:40:31 +0100
Subject:  [Announce] SECURITY: mutt-1.2.5.1 and mutt-1.3.25 released.


--zhXaljGHf11kAtnf
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Disposition: inline
Content-Transfer-Encoding: 8bit            

mutt-1.2.5.1 and mutt-1.3.25 have just been released.

These releases both fix a security hole which can be remotely
exploited. The problem was found and a fix suggested by Joost Pol
<joost@contempt.nl>.  Thanks for that.

mutt-1.2.5.1 is released as an update to the last stable version of
mutt, mutt-1.2.5.  The ONLY relevant change in this version is the
fix mentioned above.  No other bugs present in 1.2.5 have been
fixed.  You only want to upgrade to this version of mutt if you
absolutely have to stick with the mutt-1.2 series.

mutt-1.3.25 is the latest BETA version of mutt, and very close to
what will eventually become mutt-1.4.  Personally, I'd recommend
that you download and use this version.

The tar balls, with detached PGP signatures, will be available from 
<ftp://ftp.mutt.org/pub/mutt/> in some minutes.

As an alternative, you can apply the patch available from 
<ftp://ftp.mutt.org/pub/mutt/patch-1.2,3.rfc822_terminate.1> to any 
1.2 or 1.3 series mutt source code, and rebuild.


I apologize for the problem, and wish all of you a happy new year.

-- 
Thomas Roessler                        http://log.does-not-exist.org/

--zhXaljGHf11kAtnf
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)

iQEVAwUBPDIev9ImKUTOasbBAQJqSAf6AvWpzKDJumBz4rPhIoVENsSyOu4/N78b
k4em4afI6jJ0hjZmcBlQSvf0THqax+eNTRTWKnJMJ9o7Fz80usL697TEksDb8aCV
9h89JAAlRQHZIP6fjx0jr7KMmjz5i4XqG13mLm+9S52MK76wFwf5HHd+3VAzcfni
JP4EcUIGd/nNCh+MrhGTuFlRC0mZ/zOYPeyZ/iC1abXOGAWuPgDcucEd+O/n6TXp
Aw6s5xwZg26buqmQEuy5J3E3VksLqQwl3iEDFf6XijnOKjHIuPh4Lvxddg50NeTm
a0EOVmoS8ZfnIme+vnCQXKIR1vvKKsLraXEn6Jw6XwG97RSNurx5qQ==
=clc3
-----END PGP SIGNATURE-----

--zhXaljGHf11kAtnf--

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

Copyright 2014, SecurityGlobal.net LLC