Bug 239890 (CVE-2007-2683)

Description of problem:

An overflow can be caused when mutt tries to expand "&" in real name
gecos field to uppercase login, and real name string length plus login name
length is more than 256 characters.

This can be reached viea two vectors -- at startup, it expands the real name of
the user launching mutt. This is only under control of the user, so to exploit
it he would have to voluntarily malform his real name field, all he'll get
would be to execute code as himself. No security impact here.

Second vector is alias expansion. If mutt user has an alias for a
local user, in form 'alias aliasname username # and thus not "alias aliasname
User Name <username>"' mutt does exactly the same thing for username. It is
questionable how likely is it for a local user to exist in someone's alias file
and have a malicious realname though.

Version-Release number of selected component (if applicable):

mutt-1.4.2.2-5

Steps to Reproduce:

# USERNAME=$(perl -e 'print "a" x 31')
# useradd -c "&&&&&&&&& your-favourite-ascii-shellcode-here" $USERNAME
# echo alias billg $USERNAME >~/.muttrc
# mutt billg
Segmentation fault (core dumped)
#