[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <ru239p$147u$1@ciao.gmane.io>
Date: Sun, 17 Jan 2021 19:31:05 -0000 (UTC)
From: Tavis Ormandy <taviso@...il.com>
To: oss-security@...ts.openwall.com
Subject: mutt recipient parsing memory leak
Hello, I noticed mutt was leaking memory whenever I opened a particular
mailbox. I tracked down the problem: Using rfc822 groups without the madatory
labels wasn't being parsed properly.
https://tools.ietf.org/html/rfc822#section-6.2.6
(A spammer had just put some junk in there, they weren't deliberately using
exotic addressing schemes.. haha).
It turns out that you can send a small message that leaks a *lot* of memory. A
small message can leak GBs of memory, effectively preventing you from opening
your mailbox. You would need to use a different mail client to clean up the
malformed message before you can use mutt again.
I sent this upstream as a DoS, but they don't want to treat it as a security
isssue. I though I'd just send a FYI here instead in case anyone wants to
backport the patch.
Here's the bug with a repro: https://gitlab.com/muttmua/mutt/-/issues/323
Here's the patch:
https://gitlab.com/muttmua/mutt/-/commit/c059e20ea4c7cb3ee9ffd3500ffe313ae84b2545
Tavis.
--
_o) $ lynx lock.cmpxchg8b.com
/\\ _o) _o) $ finger taviso@....org
_\_V _( ) _( ) @taviso
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
