Executive brief
Elm is a legacy email client commonly used on Unix-like operating systems. A security flaw allows a local user to gain elevated system privileges by providing an unexpectedly long terminal setting. This could allow an attacker to read or modify other users' mail or gain broader access to the system.
Technical details
A stack-based buffer overflow exists in the curses.c component of Elm versions 2.4 and earlier. The vulnerability is caused by the use of the unsafe 'strcpy' function when copying the 'TERM' environment variable into a fixed-size 40-byte buffer ('termname'). Because Elm is often installed with setgid mail privileges on Linux and other platforms, a local attacker can exploit this overflow to execute arbitrary code with the privileges of the 'mail' group. The issue can be mitigated by replacing 'strcpy' with 'strncpy' to ensure bounds checking.
Affected products
- Elm Development Group Elm 2.4 and earlier
Timeline
- 1997-05-13: disclosed: Initial discovery and exploit posted to Bugtraq
- 1997-05-13: advisory: NVD published date