Critical Buffer Overflow Vulnerability in Mutt Package
Summary
ALPINE-CVE-2018-14350: An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. Affects mutt versions < 1.10.1-r0. Fixed in 1.10.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mutt is a popular text-based email client known for its flexibility and powerful features. It supports various protocols including IMAP, POP3, and SMTP, allowing users to manage their emails efficiently. However, prior to version 1.10.1, Mutt was found to be vulnerable to a stack-based buffer overflow, which could be exploited through malformed FETCH responses.
Vulnerability Detail
The vulnerability, identified as CVE-2018-14350, originates from a flaw in the imap/message.c file of Mutt versions before 1.10.1. It allows an attacker to send a specially crafted FETCH response containing a long INTERNALDATE field, leading to a stack-based buffer overflow. This could potentially allow the attacker to execute arbitrary code, resulting in unauthorized access or control over the affected system. The CVSS score for this vulnerability is 9.8, indicating a critical severity level.
How To Fix
Minimum fixed version
1.10.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade muttTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the IMAP protocol or refrain from fetching emails from untrusted sources until the package is updated to a secure version.
Conclusion
The buffer overflow vulnerability in Mutt poses a significant risk to users, particularly those utilizing the IMAP protocol. It is crucial to update to the patched version 1.10.1-r0 or later to mitigate this risk. Utilizing tools like Vulert can further enhance security by providing real-time monitoring for vulnerabilities.
See every vulnerability recorded for mutt →
FAQ
CVE-2018-14350 is a critical vulnerability in Mutt that allows for a stack-based buffer overflow via a malformed FETCH response.
You can check your version of Mutt by running 'mutt -v' in your terminal. If it's below 1.10.1, it is vulnerable.
Exploitation of this vulnerability could lead to arbitrary code execution, allowing attackers to gain unauthorized access to the system.
Yes, tools like Vulert can monitor your software for open-source vulnerabilities in real-time using just a manifest file.
Vulert provides a platform to monitor and alert for open-source vulnerabilities without requiring code access. You can check it out at https://vulert.com.
References
Related vulnerabilities
Recent vulnerabilities recorded for mutt.
