Vulnerability CVE-2008-5005

Vulnerability CVE-2008-5005

Published: 2008-11-10 Modified: 2012-02-12

Description:

Multiple stack-based buffer overflows in (1) University of Washington IMAP Toolkit 2002 through 2007c, (2) University of Washington Alpine 2.00 and earlier, and (3) Panda IMAP allow (a) local users to gain privileges by specifying a long folder extension argument on the command line to the tmail or dmail program; and (b) remote attackers to execute arbitrary code by sending e-mail to a destination mailbox name composed of a username and '+' character followed by a long string, processed by the tmail or possibly dmail program.

See advisories in our WLB2 database:

	Topic	Author	Date
High	UW/Panda IMAP [dt]mail buffer overflow	Bitsec Labs	11.11.2008

Type:

CWE-119

(Improper Restriction of Operations within the Bounds of a Memory Buffer)

CVSS2 => (AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVSS Base Score	Impact Subscore	Exploitability Subscore
10/10	10/10	10/10

Exploit range	Attack complexity	Authentication
Remote	Low	No required
Confidentiality impact	Integrity impact	Availability impact
Complete	Complete	Complete

Affected software
University of washington -> Alpine
University of washington -> Imap toolkit

References:

http://mailman2.u.washington.edu/pipermail/imap-uw/2008-October/002267.html

http://mailman2.u.washington.edu/pipermail/imap-uw/2008-October/002268.html

http://marc.info/?l=full-disclosure&m=122572590212610&w=4

http://panda.com/imap/

http://rhn.redhat.com/errata/RHSA-2009-0275.html

http://securityreason.com/securityalert/4570

http://securitytracker.com/id?1021131

http://support.avaya.com/elmodocs2/security/ASA-2009-065.htm

http://www.bitsec.com/en/rad/bsa-081103.txt

http://www.debian.org/security/2008/dsa-1685

http://www.mandriva.com/security/advisories?name=MDVSA-2009:146

http://www.openwall.com/lists/oss-security/2008/11/03/3

http://www.openwall.com/lists/oss-security/2008/11/03/4

http://www.openwall.com/lists/oss-security/2008/11/03/5

http://www.securityfocus.com/archive/1/498002/100/0/threaded

http://www.securityfocus.com/bid/32072

http://www.vupen.com/english/advisories/2008/3042

http://www.washington.edu/alpine/tmailbug.html

https://bugzilla.redhat.com/show_bug.cgi?id=469667

https://exchange.xforce.ibmcloud.com/vulnerabilities/46281

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10485

https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00058.html

https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00082.html

Vulnerability CVE-2008-5005

See advisories in our WLB2 database:

High

UW/Panda IMAP [dt]mail buffer overflow

CWE-119

CVSS2 => (AV:N/AC:L/Au:N/C:C/I:C/A:C)

10/10

10/10

10/10

Remote

Low

No required

Complete

Complete

Complete

Affected software

References: