FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2003-0721

This CVE name corresponds to:

Entered	Topic
2004-02-12	pine remotely exploitable vulnerabilities

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2003-0721 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2003-0721
Phase	Assigned(20030902)

Description

Integer signedness error in rfc2231_get_param from strings.c in PINE before 4.58 allows remote attackers to execute arbitrary code via an email that causes an out-of-bounds array access using a negative number.

References

Source	Reference
IDEFENSE	20030910 Two Exploitable Overflows in PINE
BUGTRAQ	20030915 remote Pine <= 4.56 exploit fully automatic
FULLDISC	20030911 Pine: .procmailrc rule against integer overflow
REDHAT	RHSA-2003:273
REDHAT	RHSA-2003:274
SUSE	SuSE-SA:2003:037
ENGARDE	ESA-20030911-022
BUGTRAQ	20030911 [slackware-security] security issues in pine (SSA:2003-253-01)
OVAL	oval:org.mitre.oval:def:503