mutt-1.4.1 fixes a buffer overflow.

Mutt versions 1.4.1 and 1.5.4 have just been released and will soon be available from ftp://ftp.mutt.org/mutt/. Both versions fix a buffer overflow in mutt's IMAP client code which was identified by Core Security Technologies, and fixed by Edmund Grimley Evans. A more detailed advisory will be...

IMAP Service Banner Retrieval

An IMAP Internet Message Access Protocol server is installed and running on the remote host. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid11414; scriptversion "$Revision: 1.11 $"; scriptnameenglish:"IMAP Service Banner Retrieval"; scriptcopyrightenglish:"This script...

CVE-2002-2253

Multiple buffer overflows in Cyrus Sieve / libSieve 2.1.2 and earlier allow remote attackers to execute arbitrary code via 1 a long header name, 2 a long IMAP flag, or 3 a script that generates a large number of errors that overflow the resulting error string...

CVE-2002-2325

The c-client library in Internet Message Access Protocol IMAP dated before 2002 RC2, as used by Pine 4.20 through 4.44, allows remote attackers to cause a denial of service client crash via a MIME-encoded email with Content-Type header containing an empty boundary field...

CVE-2002-2214

The phpifimapmimeheaderdecode function in the IMAP functionality in PHP before 4.2.2 allows remote attackers to cause a denial of service crash via an e-mail header with a long "To" header...

CVE-2002-2215

The imapheader function in the IMAP functionality for PHP before 4.3.0 allows remote attackers to cause a denial of service via an e-mail message with a large number of "To" addresses, which triggers an error in the rfc822writeaddress function...

CVE-2002-1782

The default configuration of University of Washington IMAP daemon wu-imapd, when running on a system that does not allow shell access, allows a local user with a valid IMAP account to read arbitrary files as that user...

DEBIAN-CVE-2002-1782

The default configuration of University of Washington IMAP daemon wu-imapd, when running on a system that does not allow shell access, allows a local user with a valid IMAP account to read arbitrary files as that user...

CVE-2002-1782

The default configuration of University of Washington IMAP daemon wu-imapd, when running on a system that does not allow shell access, allows a local user with a valid IMAP account to read arbitrary files as that user...

dsinet-sa-02-01.txt

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 DSINet Security Advisory DSINET-SA-02-01 http://www.dsinet.org/textfiles/advisories/dsinet/dsinet-sa-02-01.txt Potential DOS attack with Web-CyrAdm Program: Web-CyrAdm Credits: Remko Lodder [email protected] - http://www.dsinet.org/ Vendor: Luc de Louw...

[SECURITY] [DSA 215-1] New cyrus-imapd packages fix remote command execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 215-1 [email protected] http://www.debian.org/security/ Martin Schulze December 23th, 2002 http://www.debian.org/security/faq -...

[SECURITY] [DSA 215-1] New cyrus-imapd packages fix remote command execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 215-1 [email protected] http://www.debian.org/security/ Martin Schulze December 23th, 2002 http://www.debian.org/security/faq -...

DSA-215 cyrus-imapd - buffer overflow

Bulletin has no description...

Cyrus IMAP Server login Command Remote Overflow

According to its banner, the remote Cyrus IMAP server is vulnerable to a pre-login buffer overrun. An attacker without a valid login could exploit this, and would be able to execute arbitrary commands as the owner of the Cyrus process. This would allow full access to all users' mailboxes. This...

University of Washington IMAP Server vulnerable to buffer overflow after login

Overview A buffer overflow vulnerability exists in versions of the University of Washington IMAP Server up to and including the imap-2002 release. This vulnerability may allow an authenticated attacker to execute arbitrary code on the mail server with the privileges of the UID of the user running...

Cyrus Sieve / libSieve buffer overflow

problem ------- Cyrus' Sieve implementation contains a couple of classic string based buffer overflows in script parsing code. Anyone who can execute Sieve scripts can exploit these bugs. Versions up to libSieve 2.1.2 and Cyrus IMAP 2.1.10 are affected. Note that with Cyrus IMAP server exploiting...

Integer overflow in cyrus-imap

Integer overflow on line longer than 2Gb...

pre-login buffer overflow in Cyrus IMAP server

problem ------- Cyrus IMAP server has a a remotely exploitable pre-login buffer overflow. I checked versions 1.4 oldest in web page and 2.1.10 which both had it, so apparently all versions are affected. Problem is that literal lengths aren't verified to be in any reasonable range. The length + 2 ...

Cyrus IMAP Server contains a buffer overflow vulnerability

Overview A buffer overflow vulnerability exists in versions of Cyrus IMAP Server up to and including 2.1.10. This vulnerability may allow a remote attacker to execute arbitrary code on the mail server with the privileges of the Cyrus IMAP Server. Description Cyrus IMAP Server is an e-mail...

Cyrus IMAP pre-authentication heap overflow vulnerability

In December 2002, Timo Sirainen reported: Cyrus IMAP server has a remotely exploitable pre-login buffer overflow. ... Note that you don't have to log in before exploiting this, and since Cyrus runs everything under one UID, it's possible to read every user's mail in the system. It is unknown...