Mutt 0.91.1.1-2 (1998-04-14) the version shipped with RedHat 5.1, seems to be vulnerable to an environment overflow, making the group 'mail' exposed to access by a malicious user.
By setting the environmental settings of TERM to a buffer bigger than 239 bytes, one can cause 'mutt' to crash, causing it to execute arbitrary code. Mutt which comes with RedHat 5.1 (and is installed by default), is setgid 'mail'.
You can test to see if you are vulnerable by executing the following commands:
TERM=`perl -e'print "A"x240'`
mutt
This should result in a 'Segmentation fault'.
The original vulnerability was reported by funkySh, which his email is jn1@ATOMNET.PL.
Mutt 0.91.1-5 is reported to have the same problem, but it isn't setgid 'mail' anymore.
It seems that the overflow is caused by the development package called slang. The affected version seems to be slang-devel-0.99.38.
