PT-2003-1019 · Debian+1 · Debian+1

Alberto Solino + 3 · Published 2003-03-21 · Updated 2017-10-11 · CVE-2003-0140

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions libesmtp versions 0.8.12 mutt versions 1.4.0 through 1.5.3 Balsa version 2.0.10 and earlier

Description The issue concerns multiple vulnerabilities in certain packages of Red Hat Linux and Debian GNU/Linux operating systems, which can lead to disruption of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely. A buffer overflow in Mutt and possibly other programs that use Mutt code allows a remote malicious IMAP server to cause a denial of service and possibly execute arbitrary code via a crafted folder.

Recommendations For libesmtp version 0.8.12, update to a newer version to mitigate the risk. For mutt versions 1.4.0 through 1.5.3, update to version 1.5.4 or later to resolve the issue. For Balsa version 2.0.10 and earlier, update to version 2.0.11 or later to fix the vulnerability. As a temporary workaround, consider restricting access to the IMAP server to minimize the risk of exploitation.

Fix

Related Identifiers

BDU:2015-02552

BDU:2015-08149

BDU:2015-08150

CVE-2003-0140

DSA-268

Affected Products

Debian

Red Hat

References · 27

• http://debian.org/security/2003/dsa-268 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2003-0140 · Vendor Advisory
• http://securityfocus.com/bid/7120 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2003:041 · Vendor Advisory
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000630 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2003-109.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2003-0140 · Vendor Advisory
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000626 · Vendor Advisory
• http://novell.com/linux/security/advisories/2003_020_mutt.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-0140 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2003-0140 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-08150 · Security Note
• http://securityfocus.com/archive/1/315679 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0140 · Security Note
• http://gentoo.org/security/en/glsa/glsa-200303-19.xml · Vendor Advisory