PT-2005-3782 · Washington University+1 · Uw-Imap+1

Infamous41Md · Published 2005-10-13 · Updated 2018-10-19 · CVE-2005-2933

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions UW-IMAP versions prior to 2004g

Description The issue is related to a buffer overflow in the mail valid net parse work function in mail.c. This occurs when a mailbox name contains a single double-quote character without a closing quote, causing bytes after the double-quote to be copied into a buffer indefinitely. This can allow remote attackers to execute arbitrary code.

Recommendations For versions prior to 2004g, update to version 2004g or later to resolve the issue. As a temporary workaround, consider restricting the use of special characters in mailbox names to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2005-2933

DSA-861-1

RHSA-2005:848

RHSA-2005:850

RHSA-2005_848

RHSA-2005_850

RHSA-2006:0276

RHSA-2006_0276

Affected Products

Red Hat

Uw-Imap

References · 60

• http://debian.org/security/2005/dsa-861 · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200510-10.xml · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2005:189 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2005:194 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2005-848.html · Vendor Advisory
• ftp://patches.sgi.com/support/free/security/advisories/20060501-01-U.asc · Vendor Advisory
• http://secunia.com/advisories/17062 · Vendor Advisory
• http://securityfocus.com/archive/1/430296/100/0/threaded · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2005-850.html · Vendor Advisory
• http://securityfocus.com/archive/1/430303/100/0/threaded · Vendor Advisory
• http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0081.html · Patch
• http://slackware.com/security/viewer.php?l=slackware-security&y=2005&m=slackware-security.500161 · Vendor Advisory
• http://washington.edu/imap · Patch
• http://idefense.com/application/poi/display?id=313&type=vulnerabilities&flashstatus=true · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2005-2933 · Vendor Advisory