Buffer overflow in Mutt - #VU13921

Detailed vulnerability description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in mutt_from_base64() function in imap/auth_cram.c and imap/auth_gss.c when processing responses from IMAP server. A remote attacker that controls the IMAP server can send an overly long response to the vulnerable mail client, trigger buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system but requires that victim connects to a compromised server or the attacker is able to perform MitM (man-in-the-middle) attack.

Remediation

Sources

• https://gitlab.com/muttmua/mutt/commit/ed9d7727dc705754871e31cb41420f0ea956495b