Vulnerability Note VU#513062

metamail contains multiple buffer overflow vulnerabilities

Original Release date: 24 Feb 2004 | Last revised: 04 Mar 2004

Overview

Multiple buffer overflows in the metamail package could allow a remote attacker to execute arbitrary code on a vulnerable system. An attacker may be able to exploit these vulnerabilities via a specially-crafted email message.

Description

The metamail package is one of the first widely adopted packages developed to handle Multipurpose Internet Mail Extensions (MIME) data, and includes a number of programs for handling various MIME types. Although it is mostly historic, it is still in wide deployment in many environments. Two buffer overflows due to incorrect use of strcpy() have been discovered in various portions of the metamail codebase. According to an analysis published by Ulf Härnhammar:

    The first buffer overflow occurs when a message has encoded non-ASCII characters in the mail headers and the part that names a character set is overly long. The root of this problem is a bad strcpy() statement in the function PrintHeader() in metamail.c. [...]

    The second buffer overflow doesn't occur in the metamail executable, but in the splitmail executable that's generated when you compile the metamail package. This overflow occurs when a message has an overly long Subject header. It is caused by a bad strcpy() statement in the function ShareThisHeader() in splitmail.c. [...]

Although programs included in the metamail package can be invoked explicitly by a user from the command line, they are commonly invoked automatically by a mail reader or intermediate mail handling applications. Examples of such applications include, but are not limited to, virus scanners, spam filtering software, and mail delivery agents such as procmail. This is an important consideration since messages containing malicious code may be automatically or inadvertently passed to metamail in these cases.

NOTE: Proof-of-concept exploit code has been published for this vulnerability.

Impact

An attacker may be able to execute code of their choosing on a vulnerable system by introducing a specially-crafted MIME attachment. The code would be executed in the context of the user who invoked the metamail program or mail handling program that launched metamail.

Solution

Apply a patch from the vendor

Although the metamail package is unmaintained by the original author, some redistributors have released patches. Please see the Systems Affected section of this document for more details.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
DebianAffected-24 Feb 2004
MandrakeSoftAffected-19 Feb 2004
Red Hat Inc.Affected-04 Mar 2004
SGIAffected-04 Mar 2004
SlackwareAffected-19 Feb 2004
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

Thanks to Ulf Härnhammar for reporting this vulnerability.

This document was written by Chad R Dougherty.

Other Information

  • CVE IDs: CAN-2004-0105
  • Date Public: 18 Feb 2004
  • Date First Published: 24 Feb 2004
  • Date Last Updated: 04 Mar 2004
  • Severity Metric: 14.25
  • Document Revision: 12

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.