Date: Tue, 28 Jul 1998 20:17:57 +0200 From: Paul Boehm Subject: mutt x.x Hi, all (newer??) versions of mutt have got an overflowable buffer in parse.c. When sending an specially formated Content-Type in the header you can, when putting special purpose shellcode that doesn't contain any / ; \n and spaces execute arbitary code on the mutt running user's system. The overflows occurs when opening the mailbox containing the malicious email. So, you don't even have to view that "evil" email for this to work. Michael Elkins(mutt author) has already been notified. My personal(non official) patch is included, expect an official patch(new version?) from him soon. Use this patch against mutt 0.93(i): --snip-- --- parse.c.old Tue Jul 28 18:25:50 1998 +++ parse.c Tue Jul 28 18:25:56 1998 @@ -268,7 +268,7 @@ if ((pc = strchr(s, '/'))) { *pc++ = 0; - while (*pc && !ISSPACE (*pc) && *pc != ';') + while (*pc && !ISSPACE (*pc) && *pc != ';' && i < (SHORT_STRING - 1)) { buffer[i++] = *pc; pc++; --snip-- bye, paul -- [ Paul S. Boehm | paul@boehm.priv.at | http://paul.boehm.org/ | infected@irc ] Money is what gives a programmer his resources. It's an exchange system created by human beings. It surrounds us. Works for us, binds the economy together. --------------------------------------------------------------------------- Date: Thu, 22 Oct 1998 09:24:51 +0200 From: funkySh To: BUGTRAQ@netspace.org Subject: mutt buffer overflow? Sorry if this is already known.. There have been some posts about the buffer overflow in mutt, (by sending an specially formated Content-Type) here is another one (i think exploitable) in mutt 0.91.1-2 shipped with RH 5.1 with setgid mail [orbital@PulpFiction /]$ TERM=`perl -e 'print "A" x 240'` [orbital@PulpFiction /]$ mutt Segmentation fault [orbital@PulpFiction /]$ gdb /usr/bin/mutt ... (gdb) r Starting program: /usr/bin/mutt Program received signal SIGSEGV, Segmentation fault. 0x41414141 in ?? () Mutt 0.91.1-5 has still the same problem but setgid mail is turned off.. -- funkySh jn1@atomnet.pl PGP keyID: 768/D837F9A1 fingerprint 36 78 A6 D7 55 38 12 51 05 93 36 65 A0 6E 6D 22