Sylpheed < 1.0.3 Invalid Header Overflow

High Nessus Network Monitor Plugin ID 2672

Synopsis

The remote host is vulnerable to a buffer overflow.

Description

The remote client is running Sylpheed, an email client for Unix and Unix-like operating systems. This version is vulnerable to a buffer overflow via invalid headers. Specifically, if a specially crafted email message is replied to, a buffer overflow may occur on the local machine. To exploit this, an attacker would need to be able to craft an email and entice a local user to both read and reply to the email. Successful exploitation would result in the attacker executing arbitrary code on the remote client.

Solution

Upgrade to version 1.0.3 or higher.

Plugin Details

Severity: High

ID: 2672

File Name: 2672.prm

Family: SMTP Clients

Published: 2005/03/05

Modified: 2016/02/05

Dependencies: 1333

Risk Information

Risk Factor: High

CVSSv2

Base Score: 7.6

Temporal Score: 5.6

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

CVSSv3

Base Score: 8.1

Temporal Score: 7

Vector: CVSS3#AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS3#E:U/RL:O/RC:C

Reference Information

BID: 12730