A remote overflow exists in GNU Emacs. The movemail function fails to adequately check responses from POP3 Servers in popmail() resulting in a format string overflow. With a specially crafted response, an attacker with a malicious POP3 Server can gain remote access with privilege of the logged on user and the effective group ID of the mail group resulting in a loss of integrity.

Upgrade to version 21.4 or higher, as it has been reported to fix this vulnerability. An upgrade is required as the fix has been applied to the CVS tree rather than as a patch kit.

• Security Tracker: 1013100
• Secunia Advisory ID: 14110 14148 14168 14191 14194 14196 14240 14245 14281 14305 14307 14318 14419
• CVE ID: 2005-0100 (see also: NVD)
• Vendor Specific News/Changelog Entry: http://list-archive.xemacs.org/xemacs-announce/200502/msg00001.html
• Other Advisory URL: http://security.gentoo.org/glsa/glsa-200502-20.xml
  http://www.debian.org/security/2005/dsa-670
  http://www.debian.org/security/2005/dsa-671
  http://www.debian.org/security/2005/dsa-685
  http://www.mandrakesoft.com/security/advisories?name=MDKSA-2005:038
  http://www.novell.com/linux/security/advisories/2005_06_sr.html
  http://www.ubuntulinux.org/support/documentation/usn/usn-76-1
• Vendor URL: http://www.gnu.org/software/emacs/emacs.html
• RedHat RHSA: RHSA-2005:112 RHSA-2005:134

• Max Vozeler - maxlinux.de -