PT-2008-6903 · Washington University · University Of Washington Imap Toolkit+1
Published
1970-01-01
·
Updated
2024-02-14
·
CVE-2008-5005
CVSS v2.0
10
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
University of Washington IMAP Toolkit versions 2002 through 2007c
University of Washington Alpine version 2.00 and earlier
Description
The issue concerns multiple stack-based buffer overflows in the University of Washington IMAP Toolkit and Alpine, which can be exploited to gain privileges or execute arbitrary code. This can be achieved by specifying a long folder extension argument on the command line to the
tmail or dmail program, or by sending an email to a destination mailbox name composed of a username and '+' character followed by a long string. The exploitation can be done remotely.Recommendations
For University of Washington IMAP Toolkit versions 2002 through 2007c: Update to a version later than 2007c to resolve the issue.
For University of Washington Alpine version 2.00 and earlier: Update to a version later than 2.00 to resolve the issue.
As a temporary workaround, consider restricting access to the
tmail and dmail programs until a patch is available. Avoid using long folder extension arguments on the command line to these programs. Restrict the use of the '+' character in destination mailbox names to minimize the risk of exploitation.Fix
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alpine
University Of Washington Imap Toolkit