Dovecot IMAP/POP3 server off-by-one buffer overflow

No description provided...

ZDI-06-036: Novell Netmail User Authentication Buffer Overflow Vulnerability

ZDI-06-036: Novell Netmail User Authentication Buffer Overflow Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-06-036.html October 31, 2006 -- CVE ID: CVE-2006-5478 -- Affected Vendor: Novell -- Affected Products: Netmail 3.5.2 Novell eDirectory 8.8.1 -- TippingPointTM IPS Customer...

Hastymail IMAP/SMTP远程命令注入漏洞

Hastymail是一个用PHP编写的快速、安全、兼容RFC、跨平台的IMAP/SMTP客户端应用程序。 Hastymail在处理用户请求时存在输入验证漏洞，远程攻击者可能利用此漏洞在服务器上执行任意命令。 拥有有效Hastymail帐号的用户可以通过在Hastymail变量中嵌入“命令结束”序列直接向IMAP或SMTP服务器发送命令。这允许远程攻击者绕过安全限制，尝试攻击IMAP或SMTP服务。 Hastymail Hastymail 1.5 Hastymail Hastymail 1.0.2 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

Novell Netmail User Authentication Buffer Overflow Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell Netmail. Exploitation does not require authentication. The specific flaw exists within the user authentication component of Novell Netmail. The routine responsible for authenticating Netmail...

CVE-2006-5478

Multiple stack-based buffer overflows in Novell eDirectory 8.8.x before 8.8.1 FTF1, and 8.x up to 8.7.3.8, and Novell NetMail before 3.52e FTF2, allow remote attackers to execute arbitrary code via 1 a long HTTP Host header, which triggers an overflow in the BuildRedirectURL function; or vectors...

WU-IMAP 2000.287(1-2) Remote Exploit

No description provided by source. / 7350owex- x86/linux WU-IMAP 2000.2871-2 remote exploit TESO CONFIDENTIAL - SOURCE MATERIALS This is unpublished proprietary source code of TESO Security. The contents of these coded instructions, statements and computer programs may not be disclosed to third...

Linux imapd Remote Overflow File Retrieve Exploit

No description provided by source. / This is the remote exploit of the hole in the imap daemon, for Linux. The instruction code is doing open, write, and close system calls, and it adds a line root::0:0.. at the beggining of /etc/passwd change to /etc/shadow if needed. The code needs to be self...

Debian DSA-900-3 : fetchmail - programming error

Due to restrictive dependency definition for fetchmail-ssl the updated fetchmailconf package couldn't be installed on the old stable distribution woody together with fetchmail-ssl. Hence, this update loosens it, so that the update can be pulled in. For completeness we're including the original...

Debian DSA-1108-1 : mutt - buffer overflow

It was discovered that the mutt mail reader performs insufficient validation of values returned from an IMAP server, which might overflow a buffer and potentially lead to the injection of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks ...

Debian DSA-988-1 : squirrelmail - several vulnerabilities

Several vulnerabilities have been discovered in Squirrelmail, a commonly used webmail system. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2006-0188 Martijn Brinkers and Ben Maurer found a flaw in webmail.php that allows remote attackers to inject...

Debian DSA-939-1 : fetchmail - programming error

Daniel Drake discovered a problem in fetchmail, an SSL enabled POP3, APOP, IMAP mail gatherer/forwarder, that can cause a crash when the program is running in multidrop mode and receives messages without headers. The old stable distribution woody does not seem to be affected by this problem...

CVE-2006-5262

CRLF injection vulnerability in lib/session.php in Hastymail 1.5 and earlier before 20061008 allows remote authenticated users to send arbitrary IMAP commands via a CRLF sequence in a mailbox name. NOTE: the attack crosses privilege boundaries if the IMAP server configuration prevents a user from...

CVE-2006-5262

CRLF injection vulnerability in lib/session.php in Hastymail 1.5 and earlier before 20061008 allows remote authenticated users to send arbitrary IMAP commands via a CRLF sequence in a mailbox name. NOTE: the attack crosses privilege boundaries if the IMAP server configuration prevents a user from...

CVE-2006-5262

The CVE-2006-5262 entry describes a CRLF injection in Hastymail 1.5 and earlier (before 20061008) affecting lib/session.php. Remote authenticated users can craft a mailbox name containing CRLF to send arbitrary IMAP commands; the attack may cross privilege boundaries if the IMAP server is configu...

Hastymail 1.x - IMAP SMTP Command Injection

Hastymail 1.x - IMAP SMTP Command Injection source: https://www.securityfocus.com/bid/20424/info Hastymail is prone to an IMAP / SMTP command-injection vulnerability because it fails to sufficiently sanitize user-supplied input. An authenticated malicious user could execute arbitrary IMAP / SMTP...

Hastymail 1.x - IMAP SMTP Command Injection

source: https://www.securityfocus.com/bid/20424/info Hastymail is prone to an IMAP / SMTP command-injection vulnerability because it fails to sufficiently sanitize user-supplied input. An authenticated malicious user could execute arbitrary IMAP / SMTP commands on the affected mail server...

httpd cross-site scripting flaw in mod_imap

Cross-site scripting XSS vulnerability in the modimap module of Apache httpd before 1.3.35-dev and Apache httpd 2.0.x before 2.0.56-dev allows remote attackers to inject arbitrary web script or HTML via the Referer when using image maps...

php security update

CentOS Errata and Security Advisory CESA-2006:0669 Updated PHP packages that fix multiple security issues are now available for Red Hat Enterprise Linux 3 and 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. PHP is an HTML-embedded scripting...

Mercury Mail IMAP DELETE command buffer overflow

Added: 09/18/2006 CVE: CVE-2004-1211 BID: 11775 OSVDB: 12508 Background Mercury Mail Transport System is an e-mail server product for Windows and NetWare. Problem Buffer overflow vulnerabilities in the IMAP service allow authenticated attackers to execute arbitrary commands using long arguments t...

Mercury Mail IMAP DELETE command buffer overflow

Added: 09/18/2006 CVE: CVE-2004-1211 BID: 11775 OSVDB: 12508 Background Mercury Mail Transport System is an e-mail server product for Windows and NetWare. Problem Buffer overflow vulnerabilities in the IMAP service allow authenticated attackers to execute arbitrary commands using long arguments t...