CVE-2008-5005

Published: Nov 10, 2008Modified: Apr 23, 2026

10.0

Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 10.0 / Impact: 10.0

Source: NVD

Description

Multiple stack-based buffer overflows in (1) University of Washington IMAP Toolkit 2002 through 2007c, (2) University of Washington Alpine 2.00 and earlier, and (3) Panda IMAP allow (a) local users to gain privileges by specifying a long folder extension argument on the command line to the tmail or dmail program; and (b) remote attackers to execute arbitrary code by sending e-mail to a destination mailbox name composed of a username and '+' character followed by a long string, processed by the tmail or possibly dmail program.

Affected (20)

Products: University Of Washington: Alpine, Imap Toolkit

University Of Washington

2 products

Configuration A

20 vulnerable

Vulnerable Software	Affected Versions
University Of Washington Alpine	Version 0.80
University Of Washington Alpine	Version 0.81
University Of Washington Alpine	Version 0.82
University Of Washington Alpine	Version 0.83
University Of Washington Alpine	Version 0.98
University Of Washington Alpine	Version 0.999999
University Of Washington Alpine	Version 0.99999
University Of Washington Alpine	Version 0.9999
University Of Washington Alpine	Version 0.999
University Of Washington Alpine	Version 0.99
University Of Washington Alpine	Version 1.00
University Of Washington Alpine	Version 1.10
University Of Washington Alpine	Version 2.00
University Of Washington Imap Toolkit	Version 2002
University Of Washington Imap Toolkit	Version 2003
University Of Washington Imap Toolkit	Version 2004
University Of Washington Imap Toolkit	Version 2005
University Of Washington Imap Toolkit	Version 2006
University Of Washington Imap Toolkit	Version 2007
University Of Washington Imap Toolkit	Version 2007c

Related CWEs

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (56)

http://mailman2.u.washington.edu/pipermail/imap-uw/2008-October/002267.html

Source: cve@mitre.org

Patch

http://mailman2.u.washington.edu/pipermail/imap-uw/2008-October/002268.html

Source: cve@mitre.org

http://marc.info/?l=full-disclosure&m=122572590212610&w=4

Source: cve@mitre.org

http://panda.com/imap/

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2009-0275.html

Source: cve@mitre.org

http://secunia.com/advisories/32483

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/32512

Source: cve@mitre.org

http://secunia.com/advisories/33142

Source: cve@mitre.org

http://secunia.com/advisories/33996

Source: cve@mitre.org

http://securityreason.com/securityalert/4570

Source: cve@mitre.org

http://securitytracker.com/id?1021131

Source: cve@mitre.org

http://support.avaya.com/elmodocs2/security/ASA-2009-065.htm

Source: cve@mitre.org

http://www.bitsec.com/en/rad/bsa-081103.c

Source: cve@mitre.org

URL Repurposed

http://www.bitsec.com/en/rad/bsa-081103.txt

Source: cve@mitre.org

URL Repurposed

http://www.debian.org/security/2008/dsa-1685

Source: cve@mitre.org

http://www.mandriva.com/security/advisories?name=MDVSA-2009:146

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2008/11/03/3

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2008/11/03/4

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2008/11/03/5

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/498002/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/32072

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2008/3042

Source: cve@mitre.org

http://www.washington.edu/alpine/tmailbug.html

Source: cve@mitre.org

https://bugzilla.redhat.com/show_bug.cgi?id=469667

Source: cve@mitre.org

Patch

https://exchange.xforce.ibmcloud.com/vulnerabilities/46281

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10485

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00058.html

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00082.html

Source: cve@mitre.org

http://mailman2.u.washington.edu/pipermail/imap-uw/2008-October/002267.html

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://mailman2.u.washington.edu/pipermail/imap-uw/2008-October/002268.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://marc.info/?l=full-disclosure&m=122572590212610&w=4

Source: af854a3a-2127-422b-91ae-364da2661108

http://panda.com/imap/

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2009-0275.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/32483

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/32512

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/33142

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/33996

Source: af854a3a-2127-422b-91ae-364da2661108

http://securityreason.com/securityalert/4570

Source: af854a3a-2127-422b-91ae-364da2661108

http://securitytracker.com/id?1021131

Source: af854a3a-2127-422b-91ae-364da2661108

http://support.avaya.com/elmodocs2/security/ASA-2009-065.htm

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.bitsec.com/en/rad/bsa-081103.c

Source: af854a3a-2127-422b-91ae-364da2661108

URL Repurposed

http://www.bitsec.com/en/rad/bsa-081103.txt

Source: af854a3a-2127-422b-91ae-364da2661108

URL Repurposed

http://www.debian.org/security/2008/dsa-1685

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mandriva.com/security/advisories?name=MDVSA-2009:146

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2008/11/03/3

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2008/11/03/4

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2008/11/03/5

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/498002/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/32072

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2008/3042

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.washington.edu/alpine/tmailbug.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.redhat.com/show_bug.cgi?id=469667

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://exchange.xforce.ibmcloud.com/vulnerabilities/46281

Source: af854a3a-2127-422b-91ae-364da2661108

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10485

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00058.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00082.html

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.