CVE-2004-2301

Vulnerability

Eudora before version 6.1.1 contains a buffer overflow vulnerability in the handling of the To: header field. When an attacker sends an email with an excessively long To: value, the overflow can occur, leading to a crash. This affects all versions prior to 6.1.1 [1].

Exploitation

An attacker can exploit this vulnerability by sending a crafted email with a long To: field to a victim using a vulnerable Eudora version. No authentication or user interaction beyond receiving the email is required; the crash may occur upon previewing or opening the message.

Impact

Successful exploitation results in a denial of service (DoS) as the Eudora client crashes. There is no evidence of arbitrary code execution or data leakage; the impact is limited to application termination.

Mitigation

The vulnerability is fixed in Eudora version 6.1.1 [1]. Users should upgrade to this version or later. No workarounds are documented, and the CVE is not listed in the Known Exploited Vulnerabilities (KEV) catalog.