[SECURITY] [DSA 274-2] New mutt packages fix arbitrary code execution in potato

From: Martin Schulze (joey@infodrom.org)
Date: 04/07/03

  • Next message: Jedi/Sector One: "Multiple vulnerabilities in SheerDNS" 
    Date: Mon, 7 Apr 2003 08:05:45 +0200 (CEST)
From: joey@infodrom.org (Martin Schulze)
To: bugtraq@securityfocus.com

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    - --------------------------------------------------------------------------
    Debian Security Advisory DSA 274-2 security@debian.org
    http://www.debian.org/security/ Martin Schulze
    April 7th, 2003 http://www.debian.org/security/faq
    - --------------------------------------------------------------------------

    Package : mutt
    Vulnerability : buffer overflow
    Problem-Type : remote
    Debian-specific: no
    CVE Id : CAN-2003-0167

    Byrial Jensen discovered a couple of off-by-one buffer overflow in the
    IMAP code of Mutt, a text-oriented mail reader supporting IMAP, MIME,
    GPG, PGP and threading. This problem could potentially allow a remote
    malicious IMAP server to cause a denial of service (crash) and
    possibly execute arbitrary code via a specially crafted mail folder.

    This advisory only covers the old stable distribution (potato) since
    DSA 274-1 already fixed the stable distribution (woody). For the old
    stable distribution (potato) this problem has been fixed in version
    1.2.5-5.2.

    We recommend that you upgrade your mutt package.

    Upgrade Instructions
    - --------------------

    wget url
            will fetch the file for you
    dpkg -i file.deb
            will install the referenced file.

    If you are using the apt-get package manager, use the line for
    sources.list as given below:

    apt-get update
            will update the internal database
    apt-get upgrade
            will install corrected packages

    You may use an automated update by adding the resources from the
    footer to the proper configuration.

    Debian GNU/Linux 2.2 alias potato
    - ---------------------------------

      Source archives:

        http://security.debian.org/pool/updates/main/m/mutt/mutt_1.2.5-5.2.dsc
          Size/MD5 checksum: 590 8fb484ef4a54ae0b806136fd0c241a0b
        http://security.debian.org/pool/updates/main/m/mutt/mutt_1.2.5-5.2.diff.gz
          Size/MD5 checksum: 21591 c9efb077c78cfd7b8239cc96cf3ad8fd
        http://security.debian.org/pool/updates/main/m/mutt/mutt_1.2.5.orig.tar.gz
          Size/MD5 checksum: 1973923 0ba5367059abdd55daceb82dce6be42f

      Alpha architecture:

        http://security.debian.org/pool/updates/main/m/mutt/mutt_1.2.5-5.2_alpha.deb
          Size/MD5 checksum: 1130904 efa96771fd9e4d8c831b360e931e36f3

      ARM architecture:

        http://security.debian.org/pool/updates/main/m/mutt/mutt_1.2.5-5.2_arm.deb
          Size/MD5 checksum: 1044368 dc804baf176435e04ae30ea742777aeb

      Intel IA-32 architecture:

        http://security.debian.org/pool/updates/main/m/mutt/mutt_1.2.5-5.2_i386.deb
          Size/MD5 checksum: 1018660 4649d3d1b48600caacf6a4ca93f12408

      Motorola 680x0 architecture:

        http://security.debian.org/pool/updates/main/m/mutt/mutt_1.2.5-5.2_m68k.deb
          Size/MD5 checksum: 1001078 215b72365791489d99907b4bca2a9a7b

      PowerPC architecture:

        http://security.debian.org/pool/updates/main/m/mutt/mutt_1.2.5-5.2_powerpc.deb
          Size/MD5 checksum: 1050530 e3699e0ea5aa6f802825528929f5a529

      Sun Sparc architecture:

        http://security.debian.org/pool/updates/main/m/mutt/mutt_1.2.5-5.2_sparc.deb
          Size/MD5 checksum: 1047240 547236f863d5094f95f36d4ea6f4accc

    - ---------------------------------------------------------------------------------
    For apt-get: deb http://security.debian.org/ stable/updates main
    For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
    Mailing list: debian-security-announce@lists.debian.org
    Package info: `apt-cache show <pkg>' and http://packages.debian.org/>

    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.2.1 (GNU/Linux)

    iD8DBQE+kRU5W5ql+IAeqTIRAv7lAJ0XcjuF9tNR+9ivMackYyY7slRZyACgm8LL
    A6Sg4HLkx6wS8aQGDDSKO3o=
    =U/Cw
    -----END PGP SIGNATURE-----

  • Next message: Jedi/Sector One: "Multiple vulnerabilities in SheerDNS"

    Relevant Pages