Buffer overflow in Mutt 1.4.0 and possibly earlier versions, 1.5.x up to 1.5.3, and other programs that use Mutt code such as Balsa before 2.0.10, allows a remote malicious IMAP server to cause a denial of service (crash) and possibly execute arbitrary code via a crafted folder.

Core Security Technologies discovered a buffer overflow in the IMAP code of Mutt, a text-oriented mail reader supporting IMAP, MIME, GPG, PGP and threading. This problem allows a remote malicious IMAP server to cause a denial of service (crash) and possibly execute arbitrary code via a specially crafted mail folder.

The remote host is running a version of the Mutt email client that may be vulnerable to a buffer overrun. Specifically, it has been reported that Mutt does not handle remote internationalized folders properly. Because of this, it is possible for a malicious server to launch an attack that could result in the execution of code as the mutt user.

A vulnerability was discovered in the mutt text-mode email client in the IMAP code. This vulnerability can be exploited by a malicious IMAP server to crash mutt or even execute arbitrary code with the privilege of the user running mutt.

Update :

The packages for Mandrake Linux 9.1 and 9.1/PPC were not GPG-signed.
This has been fixed and as a result the md5sums have changed. Thanks to Mark Lyda for pointing this out.

The remote host is missing the patch for the advisory SUSE-SA:2003:020 (mutt).


Mutt is a text-based Mail User Agent (MUA).
The IMAP-code of mutt is vulnerable to a buffer overflow that can be exploited by a malicious IMAP-server to crash mutt or even execute arbitrary code with the privileges of the user running mutt.

There is no temporary fix known.

Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement.
Then, install the package using the command 'rpm -Fhv file.rpm' to apply the update.

Updated Balsa packages are available which fix potential vulnerabilities in the IMAP handling code and in libesmtp.

Balsa is a GNOME email client which includes code from Mutt.

A potential buffer overflow exists in Balsa versions 1.2 and higher when parsing mailbox names returned by an IMAP server. It is possible that a hostile IMAP server could cause arbitrary code to be executed by the user running Balsa.

Additionally, a buffer overflow in libesmtp (an SMTP library used by Balsa) before version 0.8.11 allows a hostile remote SMTP server to execute arbitrary code via a certain response or cause a denial of service via long server responses.

Users of Balsa are recommended to upgrade to these erratum packages which include updated versions of Balsa and libesmtp which are not vulnerable to these issues.

Red Hat would like to thank CORE security for discovering the vulnerability, and the Mutt team for providing a patch.

ID	Name	Product	Family	Severity
15105	Debian DSA-268-1 : mutt - buffer overflow	Nessus	Debian Local Security Checks	high
1296	Mutt < 1.4.1 / 1.5 UTF-7 IMAP Remote Folder Buffer Overflow Vulnerability	Nessus Network Monitor	SMTP Clients	medium
14025	Mandrake Linux Security Advisory : mutt (MDKSA-2003:041-1)	Nessus	Mandriva Local Security Checks	high
13790	SUSE-SA:2003:020: mutt	Nessus	SuSE Local Security Checks	high
12382	RHEL 2.1 : balsa (RHSA-2003:111)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2003-0140

critical

Tenable Plugins

high

medium

high

high

high