VMime through 0.9.2 contains an integer underflow in the uuEncoder::decode function that allows remote attackers to trigger a stack-based buffer overflow via crafted uuencoded MIME parts. Attackers can send an email with a uuencoded line whose length character is 'b' but is not a 'begin' line, corrupting stack memory to crash the application or potentially execute code.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
Passive
Minimal interaction
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v4.0
Weakness Type (CWE)
References 6
https://github.com/kisli/vmime
disclosure@vulncheck.com
https://github.com/kisli/vmime/blob/v0.9.2/src/vmime/utility/encoder/uuEncoder.…
disclosure@vulncheck.com
https://github.com/kisli/vmime/commit/e85925eddc638939f0eeb7ee55ec047d04a760d8
disclosure@vulncheck.com
https://github.com/kisli/vmime/pull/363
disclosure@vulncheck.com
https://hackmd.io/@haindpwn/vmime-uuencode-decoder-oob-write
disclosure@vulncheck.com
https://www.vulncheck.com/advisories/vmime-through-0.9.2-stack-based-buffer-ove…
disclosure@vulncheck.com