Description of problem: An overflow can be caused when mutt tries to expand "&" in real name gecos field to uppercase login, and real name string length plus login name length is more than 256 characters. This can be reached viea two vectors -- at startup, it expands the real name of the user launching mutt. This is only under control of the user, so to exploit it he would have to voluntarily malform his real name field, all he'll get would be to execute code as himself. No security impact here. Second vector is alias expansion. If mutt user has an alias for a local user, in form 'alias aliasname username # and thus not "alias aliasname User Name <username>"' mutt does exactly the same thing for username. It is questionable how likely is it for a local user to exist in someone's alias file and have a malicious realname though. Version-Release number of selected component (if applicable): mutt-1.4.2.2-5 Steps to Reproduce: # USERNAME=$(perl -e 'print "a" x 31') # useradd -c "&&&&&&&&& your-favourite-ascii-shellcode-here" $USERNAME # echo alias billg $USERNAME >~/.muttrc # mutt billg Segmentation fault (core dumped) #
As the problematic call is to memmove(), this should be caught by _FORTIFY_SOURCE=2 on FC and RHEL5, and thus have no security impact at all there.
Doesn't Affect: RHEL2.1 Affects: RHEL3 Affects: RHEL4 Doesn't Affect: RHEL5 (_FORTIFY_SOURCE, impact=none) Doesn't Affect: FC5 (_FORTIFY_SOURCE, impact=none) Doesn't Affect: FC6 (_FORTIFY_SOURCE, impact=none)
Not caught by fortify source. I had mistaken.