VMime through 0.9.2 contains an information disclosure vulnerability in the uuEncoder::decode function that writes uninitialized stack memory into decoded output for over-long lines. Attackers can send a crafted uuencode or x-uuencode MIME part with a large line length byte to leak up to 15 bytes of stack contents per line in decoded attachments.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
Passive
Minimal interaction
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
References 6
https://github.com/kisli/vmime
disclosure@vulncheck.com
https://github.com/kisli/vmime/blob/v0.9.2/src/vmime/utility/encoder/uuEncoder.…
disclosure@vulncheck.com
https://github.com/kisli/vmime/commit/e85925eddc638939f0eeb7ee55ec047d04a760d8
disclosure@vulncheck.com
https://github.com/kisli/vmime/pull/363
disclosure@vulncheck.com
https://hackmd.io/@haindpwn/vmime-uuencode-decoder-oob-write
disclosure@vulncheck.com
https://www.vulncheck.com/advisories/vmime-through-0.9.2-uninitialized-stack-me…
disclosure@vulncheck.com