103089 – mail-client/mutt buffer overflow

Bug 103089 - mail-client/mutt buffer overflow

Summary: mail-client/mutt buffer overflow

Status:	RESOLVED DUPLICATE of bug 103050

Alias:	None

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	High critical (vote)
Assignee:	Gentoo Security

URL:	http://www.securityfocus.com/bid/14596
Whiteboard:
Keywords:

Depends on:
Blocks:

Reported:	2005-08-19 16:12 UTC by Roman Pertl
Modified:	2005-08-19 23:11 UTC (History)
CC List:	0 users

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Roman Pertl 2005-08-19 16:12:53 UTC

mutt seems to be vulnerable to a buffer overflow in the attachment/encoding/
decoding functions

see http://www.derkeiler.com/Mailing-Lists/Full-Disclosure/2005-08/0594.html
http://www.securityfocus.com/bid/14596

Reproducible: Always
Steps to Reproduce:

Comment 1 Marco Morales 2005-08-19 16:19:39 UTC

It only affects openbsd as bug #103050 says :P

Comment 2 Roman Pertl 2005-08-19 16:44:15 UTC

I'm sorry to opened a new bug.. I did only a search for open bugs..

anyway, the advisory says that:

Since this and other such experiments cause the propolice 
canary to get damaged (being right next to the return address), it 
seems very likely for this to be exploitable, except on system such 
as OpenBSD that include ProPolice by default.

so it looks to me that OpenBSD is not vulnerable, but it does not definitly say 
linux is not vulnerable?

Comment 3 Tavis Ormandy (RETIRED) gentoo-dev

2005-08-19 23:11:30 UTC

definite just openbsd, the bug is in openbsd libc rather than mutt :)

*** This bug has been marked as a duplicate of 103050 ***