mutt.txt

`Date: Tue, 28 Jul 1998 20:17:57 +0200  
From: Paul Boehm <[email protected]>  
Subject: mutt x.x  
  
Hi, all (newer??) versions of mutt have got an overflowable buffer in  
parse.c. When sending an specially formated Content-Type in the header you  
can, when putting special purpose shellcode that doesn't contain any / ; \n  
and spaces execute arbitary code on the mutt running user's system.  
  
The overflows occurs when opening the mailbox containing the malicious  
email. So, you don't even have to view that "evil" email for this to work.  
  
Michael Elkins(mutt author) has already been notified. My personal(non  
official) patch is included, expect an official patch(new version?) from him  
soon.  
  
Use this patch against mutt 0.93(i):  
  
--snip--  
--- parse.c.old Tue Jul 28 18:25:50 1998  
+++ parse.c Tue Jul 28 18:25:56 1998  
@@ -268,7 +268,7 @@  
if ((pc = strchr(s, '/')))  
{  
*pc++ = 0;  
- while (*pc && !ISSPACE (*pc) && *pc != ';')  
+ while (*pc && !ISSPACE (*pc) && *pc != ';' && i < (SHORT_STRING - 1))  
{  
buffer[i++] = *pc;  
pc++;  
--snip--  
  
bye,  
paul  
  
--  
  
[ Paul S. Boehm | [email protected] | http://paul.boehm.org/ | infected@irc ]  
  
Money is what gives a programmer his resources. It's an exchange system created  
by human beings. It surrounds us. Works for us, binds the economy together.  
  
---------------------------------------------------------------------------  
  
Date: Thu, 22 Oct 1998 09:24:51 +0200  
From: funkySh <[email protected]>  
To: [email protected]  
Subject: mutt buffer overflow?  
  
Sorry if this is already known..  
  
There have been some posts about the buffer overflow in mutt,  
(by sending an specially formated Content-Type) here is another  
one (i think exploitable) in mutt 0.91.1-2 shipped with  
RH 5.1 with setgid mail  
  
[orbital@PulpFiction /]$ TERM=`perl -e 'print "A" x 240'`  
[orbital@PulpFiction /]$ mutt  
Segmentation fault  
[orbital@PulpFiction /]$ gdb /usr/bin/mutt  
...  
(gdb) r  
Starting program: /usr/bin/mutt  
  
Program received signal SIGSEGV, Segmentation fault.  
0x41414141 in ?? ()  
  
Mutt 0.91.1-5 has still the same problem but setgid mail is turned off..  
  
  
  
  
  
--  
funkySh [email protected]  
PGP keyID: 768/D837F9A1  
fingerprint 36 78 A6 D7 55 38 12 51 05 93 36 65 A0 6E 6D 22  
  
`