CVE-2008-5005

2008-11-1014:12:00

CWE-119

[email protected]

web.nvd.nist.gov

cve-2008-5005

buffer overflow

imap

alpine

privilege escalation

remote code execution

7.7 High

AI Score

Confidence

Low

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.118 Low

EPSS

Percentile

95.3%

JSON

Multiple stack-based buffer overflows in (1) University of Washington IMAP Toolkit 2002 through 2007c, (2) University of Washington Alpine 2.00 and earlier, and (3) Panda IMAP allow (a) local users to gain privileges by specifying a long folder extension argument on the command line to the tmail or dmail program; and (b) remote attackers to execute arbitrary code by sending e-mail to a destination mailbox name composed of a username and ‘+’ character followed by a long string, processed by the tmail or possibly dmail program.

CPENameOperatorVersion
university_of_washington:alpineuniversity of washington alpineeq0.82
university_of_washington:alpineuniversity of washington alpineeq0.999999
university_of_washington:alpineuniversity of washington alpineeq0.98
university_of_washington:alpineuniversity of washington alpineeq1.00
university_of_washington:alpineuniversity of washington alpineeq1.10
university_of_washington:alpineuniversity of washington alpineeq0.99
university_of_washington:alpineuniversity of washington alpineeq0.81
university_of_washington:imap_toolkituniversity of washington imap toolkiteq2003
university_of_washington:imap_toolkituniversity of washington imap toolkiteq2005
university_of_washington:imap_toolkituniversity of washington imap toolkiteq2002

CPE	Name	Operator	Version
university_of_washington:alpine	university of washington alpine	eq	0.82
university_of_washington:alpine	university of washington alpine	eq	0.999999
university_of_washington:alpine	university of washington alpine	eq	0.98
university_of_washington:alpine	university of washington alpine	eq	1.00
university_of_washington:alpine	university of washington alpine	eq	1.10
university_of_washington:alpine	university of washington alpine	eq	0.99
university_of_washington:alpine	university of washington alpine	eq	0.81
university_of_washington:imap_toolkit	university of washington imap toolkit	eq	2003
university_of_washington:imap_toolkit	university of washington imap toolkit	eq	2005
university_of_washington:imap_toolkit	university of washington imap toolkit	eq	2002