=====================================================================
                                    CERT-Renater

                         Note d'Information No. 2006/VULN368
_____________________________________________________________________

DATE                      : 30/06/2006

HARDWARE PLATFORM(S)      : /

OPERATING SYSTEM(S)       : Mandriva Linux running mutt.

======================================================================
  _______________________________________________________________________

  Mandriva Linux Security Advisory                         MDKSA-2006:115
  http://www.mandriva.com/security/
  _______________________________________________________________________

  Package : mutt
  Date    : June 28, 2006
  Affected: 10.2, 2006.0, Corporate 3.0
  _______________________________________________________________________

  Problem Description:

  A stack-based buffer overflow in the browse_get_namespace function in
  imap/browse.c of Mutt allows remote attackers to cause a denial of service
  (crash) or execute arbitrary code via long namespaces received from the
  IMAP server.

  Updated packages have been patched to address this issue.
  _______________________________________________________________________

  References:

  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2006-3242
  _______________________________________________________________________

  Updated Packages:

  Mandriva Linux 10.2:
  4754ced22986cf85a1800f1505598e37  10.2/RPMS/mutt-1.5.6i-5.1.102mdk.i586.rpm
  8821801bcfcd24e2c83a0650300ab3a6  10.2/RPMS/mutt-utf8-1.5.6i-5.1.102mdk.i586.rpm
  013916fa3ad5714b2d54fbfebc226d2f  10.2/SRPMS/mutt-1.5.6i-5.1.102mdk.src.rpm

  Mandriva Linux 10.2/X86_64:
  3a92d59daad0f99898c19ee1ec3ab5c5 
x86_64/10.2/RPMS/mutt-1.5.6i-5.1.102mdk.x86_64.rpm
  45306ab4c8ee90b95f0590e859391118 
x86_64/10.2/RPMS/mutt-utf8-1.5.6i-5.1.102mdk.x86_64.rpm
  013916fa3ad5714b2d54fbfebc226d2f  x86_64/10.2/SRPMS/mutt-1.5.6i-5.1.102mdk.src.rpm

  Mandriva Linux 2006.0:
  76aff600c45f2144b4cce08bf54bb27a  2006.0/RPMS/mutt-1.5.9i-9.1.20060mdk.i586.rpm
  7e892d544ddfb5631bd299359b828ded 
2006.0/RPMS/mutt-utf8-1.5.9i-9.1.20060mdk.i586.rpm
  9e5067db02225e3b35ce9dbdfe17050d  2006.0/SRPMS/mutt-1.5.9i-9.1.20060mdk.src.rpm

  Mandriva Linux 2006.0/X86_64:
  7e6c0716940e1b9e19155d7af11bf1fa 
x86_64/2006.0/RPMS/mutt-1.5.9i-9.1.20060mdk.x86_64.rpm
  f5315ffc0c03aa99fc7b106d4081e09d 
x86_64/2006.0/RPMS/mutt-utf8-1.5.9i-9.1.20060mdk.x86_64.rpm
  9e5067db02225e3b35ce9dbdfe17050d 
x86_64/2006.0/SRPMS/mutt-1.5.9i-9.1.20060mdk.src.rpm

  Corporate 3.0:
  bfc81580fea8bc093ee286001dc9a90d 
corporate/3.0/RPMS/mutt-1.5.5.1i-2.1.C30mdk.i586.rpm
  9979b1df2e7b70e801e362f1344cffdc 
corporate/3.0/RPMS/mutt-utf8-1.5.5.1i-2.1.C30mdk.i586.rpm
  0b5f6bdc942633d280c44c6cf064f59f 
corporate/3.0/SRPMS/mutt-1.5.5.1i-2.1.C30mdk.src.rpm

  Corporate 3.0/X86_64:
  e6093d7bd4127c7d107894514c729f12 
x86_64/corporate/3.0/RPMS/mutt-1.5.5.1i-2.1.C30mdk.x86_64.rpm
  b6390789c46013fb8396d6cc9e2b18ac 
x86_64/corporate/3.0/RPMS/mutt-utf8-1.5.5.1i-2.1.C30mdk.x86_64.rpm
  0b5f6bdc942633d280c44c6cf064f59f 
x86_64/corporate/3.0/SRPMS/mutt-1.5.5.1i-2.1.C30mdk.src.rpm
  _______________________________________________________________________

  To upgrade automatically use MandrivaUpdate or urpmi.  The verification
  of md5 checksums and GPG signatures is performed automatically for you.

  All packages are signed by Mandriva for security.  You can obtain the
  GPG public key of the Mandriva Security Team by executing:

   gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

  You can view other update advisories for Mandriva Linux at:

   http://www.mandriva.com/security/advisories

  If you want to report vulnerabilities, please contact

   security_(at)_mandriva.com
  _______________________________________________________________________

  Type Bits/KeyID     Date       User ID
  pub  1024D/22458A98 2000-07-10 Mandriva Security Team
   <security*mandriva.com>

======================================================================

           =========================================================
           Les serveurs de référence du CERT-Renater
           http://www.urec.fr/securite
           http://www.cru.fr/securite
           http://www.renater.fr
           =========================================================
           + CERT-RENATER          | tel : 01-53-94-20-44          +
           + 151 bd de l'Hopital   | fax : 01-53-94-20-41          +
           + 75013 Paris           | email: certsvp@renater.fr     +
           =========================================================