5708 : Multiple E-mail Client Long File Name MIME Overflow
Printer | http://osvdb.org/5708 | Email This | Edit Vulnerability

Views This Week
3

Views All Time
63

Info

Last Modified
7 months ago

Percent Complete
100%

Disclosure
Jul 27, 1998

Discovery
Jun 29, 1998

Dates

Exploit
Unknown

Solution
Unknown

Description

 A remote overflow exists in several mail user agents (MUAs). The MUAs fail to properly cope with tags that identify an attachment, resulting in a buffer overflow. With a specially crafted e-mail, an attacker can potentially execute arbitrary code resulting in a loss of confidentiality and/or integrity.

Classification

 Location: Remote/Network Access Required
Attack Type: Input Manipulation
Impact: Loss of Confidentiality, Loss of Integrity
Exploit: Exploit Rumored / Private
Disclosure: OSVDB Verified

Technical

 According to Netscape, this vulnerability does not apply to versions of Communicator for Windows or Macintosh.

Solution

 Upgrade to the proper version depending on the MUA installed, according to the vendor advisories, as they have been reported to fix this vulnerability. An upgrade is required as there are no known client side workarounds.

Sendmail has implemented a patch that can be implemented as a workaround if used as an MTA. The patch is listed in the external references.

Products
Hewlett-Packard Development Company, L.P.
Watch-list
dtmail
Watch-list
 1.2
Michael Elkins
Watch-list
Mutt
Watch-list
 0.93.1 (i)
Microsoft Corporation
Watch-list
Outlook Express
Watch-list
 4.27.3110
4.72.2106
Outlook
Watch-list
 98
Netscape Communications Corporation
Watch-list
Communicator
Watch-list
 4.5
4.5 BETA
Sun Microsystems, Inc.
Watch-list
mailtool
Watch-list
 4.1.3_U1
4.1.4
5.3
5.4
5.5
5.5.1
5.6
University of Washington
Watch-list
Pine
Watch-list
 4.0.2

References

Credit
  • Ari Takanen and Marko Laakso - Oulu University Secure Programming Group

Blogs

Provided by Technorati

 None found at this time

Comments

Add Comment

No Comments.

DONATE NOW!

User Status

Quick Searches

Advertisements

The database information may change without any notice. Use of the information constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the copyright holder or distributor (OSVDB or OSF) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.

© Copyright 2008 Open Source Vulnerability Database (OSVDB), All Rights Reserved.
Privacy Statement - Terms of Use