| Description: | Description:
The remote host is missing updates announced in
advisory RHSA-2007:0386.
Mutt is a text-mode mail user agent.
A flaw was found in the way Mutt used temporary files on NFS file systems.
Due to an implementation issue in the NFS protocol, Mutt was not able to
exclusively open a new file. A local attacker could conduct a
time-dependent attack and possibly gain access to e-mail attachments opened
by a victim. (CVE-2006-5297)
A flaw was found in the way Mutt processed certain APOP authentication
requests. By sending certain responses when mutt attempted to authenticate
against an APOP server, a remote attacker could potentially acquire certain
portions of a user's authentication credentials. (CVE-2007-1558)
A flaw was found in the way Mutt handled certain characters in gecos fields
which could lead to a buffer overflow. The gecos field is an entry in the
password database typically used to record general information about the
user. A local attacker could give themselves a carefully crafted Real
Name which could execute arbitrary code if a victim uses Mutt and expands
the attackers alias. (CVE-2007-2683)
All users of mutt should upgrade to this updated package, which
contains a backported patches to correct these issues.
Solution:
Please note that this update is available via
Red Hat Network. To use Red Hat Network, launch the Red
Hat Update Agent with the following command: up2date
http://rhn.redhat.com/errata/RHSA-2007-0386.html
http://www.redhat.com/security/updates/classification/#moderate
Risk factor : Medium
CVSS Score:
3.5
|
