Off-by-One Buffer Overflow Vulnerability in Mutt and Balsa
Summary
CVE-2003-0167: Multiple off-by-one buffer overflows in the IMAP capability for Mutt 1.3.28 and earlier, and Balsa 1.2.4 and earlier, allow a remote malicious IMAP server to cause a denial of service (crash) and possibly execute arbitra... Affects balsa versions < 2.0.10. Fixed in 2.0.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mutt is a popular text-based email client for Unix-like systems, known for its powerful features and flexibility. Balsa is another email client that provides a graphical interface for managing emails. Both packages are widely used for handling email protocols, including IMAP. The vulnerability in question affects versions of Mutt up to 1.3.28 and Balsa up to 1.2.4, allowing remote IMAP servers to exploit these clients through specially crafted mail folders.
Vulnerability Detail
The vulnerability, identified as CVE-2003-0167, stems from multiple off-by-one buffer overflows in the IMAP capability of Mutt and Balsa. An attacker can craft a malicious mail folder that, when accessed by the vulnerable client, can lead to a denial of service (crash) and potentially allow the execution of arbitrary code. This vulnerability poses a significant risk as it can be exploited remotely without user interaction, making it critical for users of affected versions to take immediate action.
How To Fix
Minimum fixed version
2.0.10
This is the first release that contains the fix.
sudo apt-get install --only-upgrade balsaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid accessing mail folders from untrusted IMAP servers until they can upgrade to the patched versions. Additionally, configuring the email client to use secure connections (SSL/TLS) may help mitigate some risks.
Conclusion
The off-by-one buffer overflow vulnerability in Mutt and Balsa poses a significant risk to users of these email clients. Immediate action is required to upgrade to the latest versions to mitigate potential exploits. Users should also consider using Vulert for ongoing monitoring of vulnerabilities in their software.
See every vulnerability recorded for balsa →
FAQ
CVE-2003-0167 is a vulnerability affecting Mutt and Balsa email clients, allowing remote attackers to exploit buffer overflows.
You can check your version of Mutt or Balsa by running 'mutt -v' or 'balsa --version' in the terminal.
If you cannot upgrade, avoid accessing untrusted IMAP servers and consider using secure connections.
More information can be found in the official CVE database or security advisories related to Mutt and Balsa.
Vulert monitors open-source vulnerabilities in your software using a manifest file like package-lock.json, providing real-time alerts.
Related vulnerabilities
Recent vulnerabilities recorded for balsa.
