Critical Vulnerability in Mutt: Improper Handling of NO Responses
Summary
ALPINE-CVE-2018-14349: An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/command.c mishandles a NO response without a message. Affects mutt versions < 1.10.1-r0. Fixed in 1.10.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mutt is a popular open-source email client known for its powerful features and flexibility. It supports various protocols, including IMAP, and is widely used for managing emails in a terminal environment. However, prior to version 1.10.1, Mutt had a vulnerability that could lead to improper handling of NO responses, potentially exposing users to security risks.
Vulnerability Detail
An issue was discovered in Mutt before version 1.10.1 and NeoMutt before July 16, 2018. The vulnerability is located in the imap/command.c file, which mishandles a NO response without a message. This flaw could allow an attacker to exploit the email client, leading to unauthorized access to sensitive information or denial of service. The vulnerability has a CVSS score of 9.8, indicating its critical nature and the potential for significant impact on affected systems.
How To Fix
Minimum fixed version
1.10.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade muttTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the IMAP functionality until the package is updated. Additionally, reviewing email configurations and limiting access to sensitive accounts may help mitigate risks until a patch is applied.
Conclusion
The vulnerability in Mutt poses a significant risk to users, particularly those utilizing IMAP. It is crucial to update to the latest version to mitigate potential threats. Users can also leverage tools like Vulert to monitor their applications for vulnerabilities effectively.
See every vulnerability recorded for mutt →
FAQ
The vulnerability involves improper handling of NO responses in the IMAP protocol, which can lead to security risks.
You can check your version of Mutt by running mutt -v in the terminal. If it is below 1.10.1, it is affected.
If an immediate update is not possible, consider using alternative email clients or limiting access to sensitive accounts until the vulnerability is patched.
More details can be found in the CVE database or the Alpine Linux security advisories.
Vulert monitors and alerts for open-source vulnerabilities in software using just a manifest file like package-lock.json, providing real-time insights without requiring code access.
References
Related vulnerabilities
Recent vulnerabilities recorded for mutt.
