Users login

Create an account »


Users login

Home » Hacking News » Linux/Unix e-mail and movie flaw

Linux/Unix e-mail and movie flaw

by Nikola Strahija on August 26th, 2005 Two serious security flaws have turned up in software widely distributed with Linux and Unix. The bugs affect Elm, an e-mail client still used by many Linux and Unix sysadmins, and Mplayer, a cross-platform movie player that is one of the most popular of its kind on Linux.

The Elm flaw involves a boundary error when the client reads an e-mail's "Expires" header. A specially crafted e-mail could exploit the bug to cause a buffer overflow and execute malicious code on a system, according to security researchers.

Adding to the flaw's potential impact, exploit code has begun circulating on the Internet, according to FrSIRT, which published sample code on its site.
The flaw affects Elm version 2.5 PL7 and earlier, and has been fixed in a new update, version 2.5 PL8. Red Hat, FrSIRT and advisory aggregator Secunia all gave the Elm flaw a highly critical rating.

The bug in Mplayer is the latest media-player bug to bother sysadmins. The flaw affects Mplayer versions 1.0pre7 and earlier, and hasn't been patched, according to an advisory from FrSIRT.

The flaw allows attackers to execute malicious code via a specially crafted media file, according to Sven Tantau, who discovered the flaw. The exploit is triggered by a specially crafted "strf" value in an audio header, and results in a buffer overflow, Tantau said in an advisory.

Newsletter signup

Signup to our monthly newsletter and stay in touch with IT news!

Free E-books

We've got ebooks! But they're not online. :( Please give us a few days to bring downloads back.


Have something to say or just wanna drop us a line? Please keep this in mind: to spam, we reply with spam.

Contact us »