CVE-2005-1682

Published: May 20, 2005Modified: Apr 16, 2026

2.1

Vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 3.9 / Impact: 2.9

Source: NVD

Description

JavaMail API, as used by Solstice Internet Mail Server POP3 2.0, does not properly validate the message number in the MimeMessage constructor in javax.mail.internet.InternetHeaders, which allows remote authenticated users to read other users' e-mail messages by modifying the msgno parameter. NOTE: Sun disputes this issue, stating "The report makes references to source code and files that do not exist in the mentioned products.

Affected (1)

Products: Solstice: Solstice Internet Mail Server

1 product

Solstice Internet Mail Server

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Solstice Solstice Internet Mail Server	Version pop3_2.0

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (4)

http://marc.info/?l=bugtraq&m=111653029605189&w=2

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2005/0574

Source: cve@mitre.org

Vendor Advisory

http://marc.info/?l=bugtraq&m=111653029605189&w=2

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2005/0574

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.