Vulnerability Development: /usr/bin/Mail buffer 0verfl0w

[SosPiro <sospiro () FREEMAIL IT>]

I found a buffer oveflow in /usr/bin/Mail,it's suid by default on my
Slakware 7.00  K2.2.13
This is the problem:

SunsetZer0:#Mail
Mail version 8.1 6/6/93.      Type ? for help
"/var/spool/mail/root":           2  messages  2  unread
> U  1  root                                   Thu Sep  15  02:23    33/1257
"hole in /usr/bin/Mail"
  U  2  sospiro                               Sat Oct    9  18:19  126/6192
"Owned!Owned!"
& t  0 x 2240
0:Invalid   message  number
"Source"  stack  over-pop
Segmentation Fault

sospiro

"ALl We WaNt is T0 bE HapPy"
---------------------------------