Critical IMAP Status Mailbox Literal Count Vulnerability in Mutt
Summary
ALPINE-CVE-2018-14351: An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/command.c mishandles a long IMAP status mailbox literal count size. Affects mutt versions < 1.10.1-r0. Fixed in 1.10.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mutt is a widely used text-based email client that supports various protocols, including IMAP. It is known for its powerful features, flexibility, and configurability, making it a popular choice among users who prefer command-line interfaces. However, Mutt has been found to have a critical vulnerability that affects its handling of IMAP status mailbox literal count sizes, potentially exposing users to security risks.
Vulnerability Detail
An issue was discovered in Mutt before version 1.10.1, where the imap/command.c file mishandles a long IMAP status mailbox literal count size. This vulnerability can lead to potential information disclosure and denial of service attacks, as it allows attackers to exploit the improper handling of mailbox literal counts. The vulnerability has a CVSS score of 9.8, indicating its critical nature and the severe impact it can have on affected systems.
How To Fix
Minimum fixed version
1.10.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade muttTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the IMAP protocol for accessing their mail until the package is updated. This can be done by configuring Mutt to use alternative protocols such as POP3 or local mail storage.
Conclusion
The vulnerability in Mutt regarding the mishandling of IMAP status mailbox literal count sizes poses significant risks to users. It is crucial to update to the patched version 1.10.1-r0 or later to mitigate these risks. Users are also encouraged to explore tools like Vulert for ongoing vulnerability monitoring.
See every vulnerability recorded for mutt →
FAQ
The CVSS score of this vulnerability is 9.8, indicating a critical severity level.
Mutt versions before 1.10.1 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to information disclosure and denial of service attacks, potentially compromising user data and system stability.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software by using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for mutt.
