imap-uw mail server buffer overflow in imap daemon
| imap-mailserver-bo (4338) |  Medium Risk |
Description:
The imap-uw mail server is vulnerable to various buffer overflows in the imap daemon. Authenticated users with a mail account on the imap server can overflow a buffer and execute arbitrary code with their own privileges. Only servers that do not allow interactive shell logins ("closed" servers) are considered to be vulnerable, because a closed configuration is intended to restrict users privileges on the mail server.
Platforms Affected:
- University of Washington, IMAP4rev1 12.264
Remedy:
No remedy available as of July 6, 2008.
Consequences:
Gain Access
References:
- BugTraq Mailing List, Sun Apr 16 2000 - 07:19:43 CDT, imapd4r1 v12.264 at http://archives.neohapsis.com/archives/bugtraq/2000-04/0074.html.
- FreeBSD Security Advisory FreeBSD-SA-00:14, imap-uw contains security vulnerabilities for "closed" mail servers at ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-00:14.imap-uw.asc.
- BID-1110: Univ. Of Washington imapd Buffer Overflow Vulnerabilities
- CVE-2000-0284: Buffer overflow in University of Washington imapd version 4.7 allows users with a valid account to execute commands via LIST or other commands.
Reported:
Apr 16, 2000
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net