Date: Thu, 25 Mar 2004 15:08:52 -0800 (PST)
From: [email protected]
To: [email protected], [email protected],
Subject: OpenLinux: mutt remote buffer overflow
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
______________________________________________________________________________
SCO Security Advisory
Subject: OpenLinux: mutt remote buffer overflow
Advisory number: CSSA-2004-013.0
Issue date: 2004 March 25
Cross reference: sr889558 fz528947 erg712561 CAN-2004-0078
______________________________________________________________________________
1. Problem Description
Buffer overflow in the index menu code for Mutt 1.4.1 and
earlier allows remote attackers to cause a denial of service and
possibly execute arbitrary code via certain mail messages.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CAN-2004-0078 to this issue.
2. Vulnerable Supported Versions
System Package
----------------------------------------------------------------------
OpenLinux 3.1.1 Server prior to mutt-1.2.5-13.i386.rpm
OpenLinux 3.1.1 Workstation prior to mutt-1.2.5-13.i386.rpm
3. Solution
The proper solution is to install the latest packages. Unix
users with Linux Kernel Personality can use the Caldera System
Updater, called cupdate (or kcupdate under the KDE environment),
to update these packages rather than downloading and installing
them by hand.
4. OpenLinux 3.1.1 Server
4.1 Package Location
ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2004-013.0/RPMS
4.2 Packages
0841eab516ca4fe0c95ccfcec317c2ad mutt-1.2.5-13.i386.rpm
4.3 Installation
rpm -Fvh mutt-1.2.5-13.i386.rpm
4.4 Source Package Location
ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2004-013.0/SRPMS
4.5 Source Packages
08ff88553dc3366e1e0a32f077bbd785 mutt-1.2.5-13.src.rpm
5. OpenLinux 3.1.1 Workstation
5.1 Package Location
ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2004-013.0/RPMS
5.2 Packages
82ed6b14289ad7217dc30af238127854 mutt-1.2.5-13.i386.rpm
5.3 Installation
rpm -Fvh mutt-1.2.5-13.i386.rpm
5.4 Source Package Location
ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2004-013.0/SRPMS
5.5 Source Packages
823f373aeb88f47575edf9a11bd8beba mutt-1.2.5-13.src.rpm
6. References
Specific references for this advisory:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0078http://marc.theaimsgroup.com/?l=bugtraq&m=107651677817933&w=2
SCO security resources:
http://www.thescogroup.com/support/security/index.html
This security fix closes SCO incidents sr889558 fz528947
erg712561.
7. Disclaimer
SCO is not responsible for the misuse of any of the information
we provide on this website and/or through our security
advisories. Our advisories are a service to our customers intended
to promote secure installation and use of SCO products.
8. Acknowledgements
The problem in the stable mutt code base was originally reported
to Red Hat by Niels Heinen.
______________________________________________________________________________
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (SCO/UNIX_SVR5)
iD8DBQFAYzrdbluZssSXDTERAvHCAKCunEpe6tBboQyQX+9mmBMzozku9ACfc2W7
5UnKkPlljK7ZGeVueZk5G3g=
=P7xK
-----END PGP SIGNATURE-----
