BID:12730

Sylpheed Mail Client Buffer Overflow Vulnerability

Info

Sylpheed Mail Client Buffer Overflow Vulnerability

Bugtraq ID:	12730
Class:	Boundary Condition Error
CVE:	CVE-2005-0667
Remote:	Yes
Local:	No
Published:	Mar 04 2005 12:00AM
Updated:	Jul 12 2009 10:56AM
Credit:	The vendor announced this vulnerability.
Vulnerable:	Sylpheed sylpheed-claws 1.0.2 Sylpheed Sylpheed 1.0.2 Sylpheed Sylpheed 1.0.1 Sylpheed Sylpheed 1.0 .0 + Turbolinux Home + Turbolinux Turbolinux Desktop 10.0 + Turbolinux Turbolinux Server 10.0 + Turbolinux Turbolinux Server 8.0 + Turbolinux Turbolinux Server 7.0 + Turbolinux Turbolinux Workstation 8.0 + Turbolinux Turbolinux Workstation 7.0 Sylpheed Sylpheed 0.9.99 Sylpheed Sylpheed 0.9.12 Sylpheed Sylpheed 0.9.11 Sylpheed Sylpheed 0.9.10 Sylpheed Sylpheed 0.9.9 Sylpheed Sylpheed 0.9.8 Sylpheed Sylpheed 0.9.7 Sylpheed Sylpheed 0.9.6 Sylpheed Sylpheed 0.9.5 Sylpheed Sylpheed 0.9.4 + S.u.S.E. Linux Personal 9.3 + S.u.S.E. Linux Personal 9.2 x86_64 + S.u.S.E. Linux Personal 9.2 + S.u.S.E. Linux Personal 9.1 x86_64 + S.u.S.E. Linux Personal 9.1 + S.u.S.E. Linux Personal 9.0 x86_64 + S.u.S.E. Linux Personal 9.0 Sylpheed Sylpheed 0.8.11 Redhat Fedora Core3 Redhat Enterprise Linux WS 2.1 IA64 Redhat Enterprise Linux WS 2.1 Redhat Enterprise Linux ES 2.1 IA64 Redhat Enterprise Linux ES 2.1 Redhat Enterprise Linux AS 2.1 IA64 Redhat Enterprise Linux AS 2.1 Redhat Advanced Workstation for the Itanium Processor 2.1 IA64 Redhat Advanced Workstation for the Itanium Processor 2.1 Gentoo Linux ALT Linux ALT Linux Junior 2.3 ALT Linux ALT Linux Compact 2.3

Not Vulnerable:	Sylpheed Sylpheed 1.0.4 + Debian Linux 3.1 sparc + Debian Linux 3.1 s/390 + Debian Linux 3.1 ppc + Debian Linux 3.1 mipsel + Debian Linux 3.1 mips + Debian Linux 3.1 m68k + Debian Linux 3.1 ia-64 + Debian Linux 3.1 ia-32 + Debian Linux 3.1 hppa + Debian Linux 3.1 arm + Debian Linux 3.1 amd64 + Debian Linux 3.1 alpha + Debian Linux 3.1 Sylpheed Sylpheed 1.0.3 + Gentoo Linux 1.4 _rc3 + Gentoo Linux 1.4 _rc2 + Gentoo Linux 1.4 _rc1 + Gentoo Linux 1.4

Discussion

Sylpheed Mail Client Buffer Overflow Vulnerability

It is reported that Sylpheed is susceptible to a buffer overflow vulnerability. This issue is due to a failure of the application to properly bounds-check user-supplied input data prior to copying it to fixed-size memory buffers.

Attackers may exploit this vulnerability to execute arbitrary machine code in the context of the vulnerable application.

Versions prior to 1.0.3 are reported to be vulnerable.

Exploit / POC

Sylpheed Mail Client Buffer Overflow Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Solution / Fix

Sylpheed Mail Client Buffer Overflow Vulnerability

Solution:
The vendor has released version 1.0.3 of Sylpheed to address this issue.

ALT Linux has released updates dealing with this and other issues. Please see the reference section for more information.

Gentoo has released an advisory (GLSA 200503-26) and an updated eBuild to address this vulnerability. Gentoo users that are running the affected software may apply the update by issuing the following sequence of commands as a superuser:
Sylpheed:
emerge --sync
emerge --ask --oneshot --verbose ">=mail-client/sylpheed-1.0.3"

Sylpheed-claws:
emerge --sync
emerge --ask --oneshot --verbose ">=mail-client/sylpheed-claws-1.0.3"

Red Hat has released an advisory (FEDORA-2005-211) and fixes to address this issue in Fedora Core 3. Please see the referenced advisory for further details regarding obtaining and applying an appropriate fix.

Red Hat has released an advisory RHSA-2005:303-05 to address this issue. Please see the referenced advisory for more information.

SuSE Linux has released an advisory (SUSE-SR:2005:011) along with updates dealing with this issue. Please see the referenced advisory for more information.

TurboLinux has released advisory TLSA-2005-44 along with fixes dealing with this issue. Please see the referenced advisory for more information.

Sylpheed Sylpheed 0.8.11