Multiple stack-based buffer overflows in the (1) conv_jistoeuc, (2) conv_euctojis, and (3) conv_sjistoeuc functions in codeconv.c in Claws Mail before 3.13.1 allow remote attackers to have unspecified impact via a crafted email, involving Japanese character set conversion.

The remote host is affected by the vulnerability described in GLSA-201606-11 (claws-mail: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in claws-mail. Please       review the CVE identifiers referenced below for details.
  Impact :

    An attacker could possibly intercept communications due to the default       implementation of SSL 3.0.
  Workaround :

    There is no known workaround at this time.

Update from 3.12.0 to 3.13.1 for bug-fixes. Includes security fix for CVE-2015-8614.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for claws-mail fixes the following issues :

  - CVE-2015-8614: additional fixes for buffer overrun     issues which allowed remote attackers to cause a crash     or have unspecified further impact (boo#959993)

'DrWhax' of the Tails project reported that Claws Mail is missing range checks in some text conversion functions. A remote attacker could exploit this to run arbitrary code under the account of a user that receives a message from them using Claws Mail.

DrWhax reports :

So in codeconv.c there is a function for Japanese character set conversion called conv_jistoeuc(). There is no bounds checking on the output buffer, which is created on the stack with alloca() Bug can be triggered by sending an email to TAILS_luser@riseup.net or whatever.

Since my C is completely rusty, you might be able to make a better judgment on the severity of this issue. Marking critical for now.

'DrWhax' of the Tails project reported that Claws Mail is missing range checks in some text conversion functions. A remote attacker could exploit this to run arbitrary code under the account of a user that receives a message from them using Claws Mail.

CVE-2015-8614

There were no checks on the output length for conversions between JIS (ISO-2022-JP) and EUC-JP, between JIS and UTF-8, and from Shift_JIS to EUC-JP.

CVE-2015-8708

The original fix for CVE-2015-8614 was incomplete.

For the oldoldstable distribution (squeeze), these problems have been fixed in version 3.7.6-4+squeeze2.

For the oldstable distribution (wheezy) and the stable distribution (jessie), this will be fixed soon. These versions were built with hardening features that make this issue harder to exploit.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for claws-mail fixes the following security issue :

  - CVE-2015-8614: buffer overrun issues in Japanese     character set conversion code could allow an adversary     to remotely crash claws and potentially have further     unspecified impact (boo#959993)

ID	Name	Product	Family	Severity
91842	GLSA-201606-11 : claws-mail: Multiple Vulnerabilities (POODLE)	Nessus	Gentoo Local Security Checks	high
89360	Fedora 23 : claws-mail-3.13.1-4.fc23 (2015-aa14be8d92)	Nessus	Fedora Local Security Checks	high
89215	Fedora 22 : claws-mail-3.13.1-4.fc22 (2015-3a073171c3)	Nessus	Fedora Local Security Checks	high
88825	openSUSE Security Update : claws-mail (openSUSE-2016-219)	Nessus	SuSE Local Security Checks	high
88774	openSUSE Security Update : claws-mail (openSUSE-2016-214)	Nessus	SuSE Local Security Checks	high
88110	Debian DSA-3452-1 : claws-mail - security update	Nessus	Debian Local Security Checks	high
87997	FreeBSD : claws-mail -- no bounds checking on the output buffer in conv_jistoeuc, conv_euctojis, conv_sjistoeuc (51358314-bec8-11e5-82cd-bcaec524bf84)	Nessus	FreeBSD Local Security Checks	high
87884	Debian DLA-383-1 : claws-mail security update	Nessus	Debian Local Security Checks	high
87718	openSUSE Security Update : claws-mail (openSUSE-2016-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2015-8614

high

Tenable Plugins

high

high

high

high

high

high

high

high

high