Gnome GMIME_UUENCODE_LEN() Macro Buffer Overflow Vulnerability

Bugtraq ID:	38078
Class:	Boundary Condition Error
CVE:	CVE-2010-0409
Remote:	Yes
Local:	No
Published:	Feb 03 2010 12:00AM
Updated:	Apr 13 2015 09:32PM
Credit:	The vendor.
Vulnerable:	SuSE SUSE Linux Enterprise 11 S.u.S.E. openSUSE 11.2 S.u.S.E. openSUSE 11.1 S.u.S.E. openSUSE 11.0 GNOME GMime 2.4.14 Gentoo Linux Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0
Not Vulnerable:	GNOME GMime 2.4.15

Gnome GMIME_UUENCODE_LEN() Macro Buffer Overflow Vulnerability

Gnome GMime is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.

Attackers can exploit this issue to execute arbitrary code in the context of an application that uses the library. Failed exploits may cause denial-of-service conditions.

Versions prior to GMime 2.4.15 are affected.

Gnome GMIME_UUENCODE_LEN() Macro Buffer Overflow Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Gnome GMIME_UUENCODE_LEN() Macro Buffer Overflow Vulnerability

Solution:
The vendor has released updates. Please see the references for details.


Debian Linux 5.0 hppa

• Debian libgmime-2.0-2-dev_2.2.22-2+lenny2_hppa.deb
  http://security.debian.org/pool/updates/main/g/gmime2.2/libgmime-2.0-2 -dev_2.2.22-2+lenny2_hppa.deb


• Debian libgmime-2.0-2-doc_2.2.22-2+lenny2_all.deb
  http://security.debian.org/pool/updates/main/g/gmime2.2/libgmime-2.0-2 -doc_2.2.22-2+lenny2_all.deb


• Debian libgmime-2.0-2a_2.2.22-2+lenny2_hppa.deb
  http://security.debian.org/pool/updates/main/g/gmime2.2/libgmime-2.0-2 a_2.2.22-2+lenny2_hppa.deb


• Debian libgmime2.2-cil_2.2.22-2+lenny2_all.deb
  http://security.debian.org/pool/updates/main/g/gmime2.2/libgmime2.2-ci l_2.2.22-2+lenny2_all.deb

Debian Linux 5.0 ia-64

• Debian libgmime-2.0-2-dev_2.2.22-2+lenny2_ia64.deb
  http://security.debian.org/pool/updates/main/g/gmime2.2/libgmime-2.0-2 -dev_2.2.22-2+lenny2_ia64.deb


• Debian libgmime-2.0-2-doc_2.2.22-2+lenny2_all.deb
  http://security.debian.org/pool/updates/main/g/gmime2.2/libgmime-2.0-2 -doc_2.2.22-2+lenny2_all.deb


• Debian libgmime-2.0-2a_2.2.22-2+lenny2_ia64.deb
  http://security.debian.org/pool/updates/main/g/gmime2.2/libgmime-2.0-2 a_2.2.22-2+lenny2_ia64.deb


• Debian libgmime2.2-cil_2.2.22-2+lenny2_all.deb
  http://security.debian.org/pool/updates/main/g/gmime2.2/libgmime2.2-ci l_2.2.22-2+lenny2_all.deb

Debian Linux 5.0 m68k

• Debian libgmime-2.0-2-doc_2.2.22-2+lenny2_all.deb
  http://security.debian.org/pool/updates/main/g/gmime2.2/libgmime-2.0-2 -doc_2.2.22-2+lenny2_all.deb


• Debian libgmime2.2-cil_2.2.22-2+lenny2_all.deb
  http://security.debian.org/pool/updates/main/g/gmime2.2/libgmime2.2-ci l_2.2.22-2+lenny2_all.deb

Debian Linux 5.0 arm

• Debian libgmime-2.0-2-dev_2.2.22-2+lenny2_arm.deb
  http://security.debian.org/pool/updates/main/g/gmime2.2/libgmime-2.0-2 -dev_2.2.22-2+lenny2_arm.deb


• Debian libgmime-2.0-2-doc_2.2.22-2+lenny2_all.deb
  http://security.debian.org/pool/updates/main/g/gmime2.2/libgmime-2.0-2 -doc_2.2.22-2+lenny2_all.deb


• Debian libgmime-2.0-2a_2.2.22-2+lenny2_arm.deb
  http://security.debian.org/pool/updates/main/g/gmime2.2/libgmime-2.0-2 a_2.2.22-2+lenny2_arm.deb


• Debian libgmime2.2-cil_2.2.22-2+lenny2_all.deb
  http://security.debian.org/pool/updates/main/g/gmime2.2/libgmime2.2-ci l_2.2.22-2+lenny2_all.deb

Debian Linux 5.0 armel

• Debian libgmime-2.0-2-dev_2.2.22-2+lenny2_armel.deb
  http://security.debian.org/pool/updates/main/g/gmime2.2/libgmime-2.0-2 -dev_2.2.22-2+lenny2_armel.deb


• Debian libgmime-2.0-2-doc_2.2.22-2+lenny2_all.deb
  http://security.debian.org/pool/updates/main/g/gmime2.2/libgmime-2.0-2 -doc_2.2.22-2+lenny2_all.deb


• Debian libgmime-2.0-2a_2.2.22-2+lenny2_armel.deb
  http://security.debian.org/pool/updates/main/g/gmime2.2/libgmime-2.0-2 a_2.2.22-2+lenny2_armel.deb


• Debian libgmime2.2-cil_2.2.22-2+lenny2_all.deb
  http://security.debian.org/pool/updates/main/g/gmime2.2/libgmime2.2-ci l_2.2.22-2+lenny2_all.deb

Debian Linux 5.0

• Debian libgmime-2.0-2-doc_2.2.22-2+lenny2_all.deb
  http://security.debian.org/pool/updates/main/g/gmime2.2/libgmime-2.0-2 -doc_2.2.22-2+lenny2_all.deb


• Debian libgmime2.2-cil_2.2.22-2+lenny2_all.deb
  http://security.debian.org/pool/updates/main/g/gmime2.2/libgmime2.2-ci l_2.2.22-2+lenny2_all.deb

Debian Linux 5.0 alpha

• Debian libgmime-2.0-2-dev_2.2.22-2+lenny2_alpha.deb
  http://security.debian.org/pool/updates/main/g/gmime2.2/libgmime-2.0-2 -dev_2.2.22-2+lenny2_alpha.deb


• Debian libgmime-2.0-2-doc_2.2.22-2+lenny2_all.deb
  http://security.debian.org/pool/updates/main/g/gmime2.2/libgmime-2.0-2 -doc_2.2.22-2+lenny2_all.deb


• Debian libgmime-2.0-2a_2.2.22-2+lenny2_alpha.deb
  http://security.debian.org/pool/updates/main/g/gmime2.2/libgmime-2.0-2 a_2.2.22-2+lenny2_alpha.deb


• Debian libgmime2.2-cil_2.2.22-2+lenny2_all.deb
  http://security.debian.org/pool/updates/main/g/gmime2.2/libgmime2.2-ci l_2.2.22-2+lenny2_all.deb

Debian Linux 5.0 amd64

• Debian libgmime-2.0-2-dev_2.2.22-2+lenny2_amd64.deb
  http://security.debian.org/pool/updates/main/g/gmime2.2/libgmime-2.0-2 -dev_2.2.22-2+lenny2_amd64.deb


• Debian libgmime-2.0-2-doc_2.2.22-2+lenny2_all.deb
  http://security.debian.org/pool/updates/main/g/gmime2.2/libgmime-2.0-2 -doc_2.2.22-2+lenny2_all.deb


• Debian libgmime-2.0-2a_2.2.22-2+lenny2_amd64.deb
  http://security.debian.org/pool/updates/main/g/gmime2.2/libgmime-2.0-2 a_2.2.22-2+lenny2_amd64.deb


• Debian libgmime2.2-cil_2.2.22-2+lenny2_all.deb
  http://security.debian.org/pool/updates/main/g/gmime2.2/libgmime2.2-ci l_2.2.22-2+lenny2_all.deb

Debian Linux 5.0 ia-32

• Debian libgmime-2.0-2-dev_2.2.22-2+lenny2_i386.deb
  http://security.debian.org/pool/updates/main/g/gmime2.2/libgmime-2.0-2 -dev_2.2.22-2+lenny2_i386.deb


• Debian libgmime-2.0-2-doc_2.2.22-2+lenny2_all.deb
  http://security.debian.org/pool/updates/main/g/gmime2.2/libgmime-2.0-2 -doc_2.2.22-2+lenny2_all.deb


• Debian libgmime-2.0-2a_2.2.22-2+lenny2_i386.deb
  http://security.debian.org/pool/updates/main/g/gmime2.2/libgmime-2.0-2 a_2.2.22-2+lenny2_i386.deb


• Debian libgmime2.2-cil_2.2.22-2+lenny2_all.deb
  http://security.debian.org/pool/updates/main/g/gmime2.2/libgmime2.2-ci l_2.2.22-2+lenny2_all.deb

Debian Linux 5.0 mips

• Debian libgmime-2.0-2-doc_2.2.22-2+lenny2_all.deb
  http://security.debian.org/pool/updates/main/g/gmime2.2/libgmime-2.0-2 -doc_2.2.22-2+lenny2_all.deb


• Debian libgmime2.2-cil_2.2.22-2+lenny2_all.deb
  http://security.debian.org/pool/updates/main/g/gmime2.2/libgmime2.2-ci l_2.2.22-2+lenny2_all.deb

Debian Linux 5.0 s/390

• Debian libgmime-2.0-2-dev_2.2.22-2+lenny2_s390.deb
  http://security.debian.org/pool/updates/main/g/gmime2.2/libgmime-2.0-2 -dev_2.2.22-2+lenny2_s390.deb


• Debian libgmime-2.0-2-doc_2.2.22-2+lenny2_all.deb
  http://security.debian.org/pool/updates/main/g/gmime2.2/libgmime-2.0-2 -doc_2.2.22-2+lenny2_all.deb


• Debian libgmime-2.0-2a_2.2.22-2+lenny2_s390.deb
  http://security.debian.org/pool/updates/main/g/gmime2.2/libgmime-2.0-2 a_2.2.22-2+lenny2_s390.deb


• Debian libgmime2.2-cil_2.2.22-2+lenny2_all.deb
  http://security.debian.org/pool/updates/main/g/gmime2.2/libgmime2.2-ci l_2.2.22-2+lenny2_all.deb

Debian Linux 5.0 mipsel

• Debian libgmime-2.0-2-dev_2.2.22-2+lenny2_mipsel.deb
  http://security.debian.org/pool/updates/main/g/gmime2.2/libgmime-2.0-2 -dev_2.2.22-2+lenny2_mipsel.deb


• Debian libgmime-2.0-2-doc_2.2.22-2+lenny2_all.deb
  http://security.debian.org/pool/updates/main/g/gmime2.2/libgmime-2.0-2 -doc_2.2.22-2+lenny2_all.deb


• Debian libgmime-2.0-2a_2.2.22-2+lenny2_mipsel.deb
  http://security.debian.org/pool/updates/main/g/gmime2.2/libgmime-2.0-2 a_2.2.22-2+lenny2_mipsel.deb


• Debian libgmime2.2-cil_2.2.22-2+lenny2_all.deb
  http://security.debian.org/pool/updates/main/g/gmime2.2/libgmime2.2-ci l_2.2.22-2+lenny2_all.deb

Debian Linux 5.0 powerpc

• Debian libgmime-2.0-2-doc_2.2.22-2+lenny2_all.deb
  http://security.debian.org/pool/updates/main/g/gmime2.2/libgmime-2.0-2 -doc_2.2.22-2+lenny2_all.deb


• Debian libgmime2.2-cil_2.2.22-2+lenny2_all.deb
  http://security.debian.org/pool/updates/main/g/gmime2.2/libgmime2.2-ci l_2.2.22-2+lenny2_all.deb

Debian Linux 5.0 sparc

• Debian libgmime-2.0-2-dev_2.2.22-2+lenny2_sparc.deb
  http://security.debian.org/pool/updates/main/g/gmime2.2/libgmime-2.0-2 -dev_2.2.22-2+lenny2_sparc.deb


• Debian libgmime-2.0-2-doc_2.2.22-2+lenny2_all.deb
  http://security.debian.org/pool/updates/main/g/gmime2.2/libgmime-2.0-2 -doc_2.2.22-2+lenny2_all.deb


• Debian libgmime-2.0-2a_2.2.22-2+lenny2_sparc.deb
  http://security.debian.org/pool/updates/main/g/gmime2.2/libgmime-2.0-2 a_2.2.22-2+lenny2_sparc.deb


• Debian libgmime2.2-cil_2.2.22-2+lenny2_all.deb
  http://security.debian.org/pool/updates/main/g/gmime2.2/libgmime2.2-ci l_2.2.22-2+lenny2_all.deb

GNOME GMime 2.4.14

• GNOME gmime-2.4.15.tar.gz
  http://ftp.acc.umu.se/pub/GNOME/sources/gmime/2.4/gmime-2.4.15.tar.gz

Gnome GMIME_UUENCODE_LEN() Macro Buffer Overflow Vulnerability

References:

• GMime 2.4.15 changelog (Gnome)
  
• GMime Homepage (GNOME)