| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20040325230852.B2A3026101@helix.pdev.ca.sco.com> Date: Thu, 25 Mar 2004 15:08:52 -0800 (PST) From: please_reply_to_security@....com To: announce@...ts.caldera.com, bugtraq@...urityfocus.com, full-disclosure@...ts.netsys.com, security-alerts@...uxsecurity.com Subject: OpenLinux: mutt remote buffer overflow -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ______________________________________________________________________________ SCO Security Advisory Subject: OpenLinux: mutt remote buffer overflow Advisory number: CSSA-2004-013.0 Issue date: 2004 March 25 Cross reference: sr889558 fz528947 erg712561 CAN-2004-0078 ______________________________________________________________________________ 1. Problem Description Buffer overflow in the index menu code for Mutt 1.4.1 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via certain mail messages. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0078 to this issue. 2. Vulnerable Supported Versions System Package ---------------------------------------------------------------------- OpenLinux 3.1.1 Server prior to mutt-1.2.5-13.i386.rpm OpenLinux 3.1.1 Workstation prior to mutt-1.2.5-13.i386.rpm 3. Solution The proper solution is to install the latest packages. Unix users with Linux Kernel Personality can use the Caldera System Updater, called cupdate (or kcupdate under the KDE environment), to update these packages rather than downloading and installing them by hand. 4. OpenLinux 3.1.1 Server 4.1 Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2004-013.0/RPMS 4.2 Packages 0841eab516ca4fe0c95ccfcec317c2ad mutt-1.2.5-13.i386.rpm 4.3 Installation rpm -Fvh mutt-1.2.5-13.i386.rpm 4.4 Source Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2004-013.0/SRPMS 4.5 Source Packages 08ff88553dc3366e1e0a32f077bbd785 mutt-1.2.5-13.src.rpm 5. OpenLinux 3.1.1 Workstation 5.1 Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2004-013.0/RPMS 5.2 Packages 82ed6b14289ad7217dc30af238127854 mutt-1.2.5-13.i386.rpm 5.3 Installation rpm -Fvh mutt-1.2.5-13.i386.rpm 5.4 Source Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2004-013.0/SRPMS 5.5 Source Packages 823f373aeb88f47575edf9a11bd8beba mutt-1.2.5-13.src.rpm 6. References Specific references for this advisory: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0078 http://marc.theaimsgroup.com/?l=bugtraq&m=107651677817933&w=2 SCO security resources: http://www.thescogroup.com/support/security/index.html This security fix closes SCO incidents sr889558 fz528947 erg712561. 7. Disclaimer SCO is not responsible for the misuse of any of the information we provide on this website and/or through our security advisories. Our advisories are a service to our customers intended to promote secure installation and use of SCO products. 8. Acknowledgements The problem in the stable mutt code base was originally reported to Red Hat by Niels Heinen. ______________________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (SCO/UNIX_SVR5) iD8DBQFAYzrdbluZssSXDTERAvHCAKCunEpe6tBboQyQX+9mmBMzozku9ACfc2W7 5UnKkPlljK7ZGeVueZk5G3g= =P7xK -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Powered by blists - more mailing lists