Preemptive Protection against Novell NetMail IMAP 'APPEND' Buffer Overflow Vulnerability

Novell NetMail is an electronic mail server product that supports various email access and exchange protocols, including the Internet Message Access Protocol IMAP. IMAP is a standard protocol for accessing e-mail from a local server that provides management of received messages on a remote server...

Fetchmail多个密码信息泄露漏洞

Fetchmail是一款多功能的IMAP和POP客户程序。 Fetchmail存在设计问题，远程攻击者可以利用漏洞可能获得用户密码敏感信息。 具体问题如下： -sslcertck/sslfingerprint选项本来必须应用到"sslproto tls1"来迫使使用TLS协商，但程序没有。 -在配置文件中即使使用"sslproto tls1"，但如果STLS/STARTTLS没有使用，获取邮件也是明文过程。 -无论TLS选项是否采用，POP3的抓取完全忽略TLS，因为在检查STLS支持前没有可靠的发送CAPA，而CAPA是STLS所必须的。无论CAPA是否检测到，依靠的是"auth"选项...

Novell NetMail IMAP AUTHENTICATE Buffer Overflow

This module exploits a stack buffer overflow in Novell's NetMail 3.52 IMAP AUTHENTICATE GSSAPI command. By sending an overly long string, an attacker can overwrite the buffer and control program execution. Using the PAYLOAD of windows/shellbindtcp or windows/shellreversetcp allows for the most...

NetMail IMAP APPEND command buffer overflow

Added: 12/29/2006 CVE: CVE-2006-6425 BID: 21723 OSVDB: 31362 Background Novell NetMail is an e-mail and calendaring server application. Problem A buffer overflow in the NetMail IMAP service allows remote, authenticated attackers to execute arbitrary commands by sending a long, specially crafted...

NetMail IMAP APPEND command buffer overflow

Added: 12/29/2006 CVE: CVE-2006-6425 BID: 21723 OSVDB: 31362 Background Novell NetMail is an e-mail and calendaring server application. Problem A buffer overflow in the NetMail IMAP service allows remote, authenticated attackers to execute arbitrary commands by sending a long, specially crafted...

NetMail IMAP APPEND command buffer overflow

Added: 12/29/2006 CVE: CVE-2006-6425 BID: 21723 OSVDB: 31362 Background Novell NetMail is an e-mail and calendaring server application. Problem A buffer overflow in the NetMail IMAP service allows remote, authenticated attackers to execute arbitrary commands by sending a long, specially crafted...

NetMail IMAP APPEND command buffer overflow

Added: 12/29/2006 CVE: CVE-2006-6425 BID: 21723 OSVDB: 31362 Background Novell NetMail is an e-mail and calendaring server application. Problem A buffer overflow in the NetMail IMAP service allows remote, authenticated attackers to execute arbitrary commands by sending a long, specially crafted...

Novell Netmail IMAP APPEND远程拒绝服务漏洞

Novell Netmail是一款电子邮件和日历系统。 Novell Netmail包含的IMAP实现处理append命令存在设计缺陷，远程攻击者可以利用漏洞对服务程序进行拒绝服务攻击。 目前没有详细漏洞细节提供。 Novell NetMail 3.52 D Novell NetMail 3.52 C1 Novell NetMail 3.52 C Novell NetMail 3.52 B Novell NetMail 3.52 A Novell NetMail 3.52 Novell NetMail 3.52 Novell nm352eftf2lx.tgz NetMail 3.52e...

Novell Netmail IMAP SUBSCRIBE缓冲区溢出漏洞

Novell Netmail是一款电子邮件和日历系统。 Novell Netmail包含的IMAP实现处理subscribe命令存在设计缺陷，远程攻击者可以利用漏洞进行缓冲区溢出攻击，可能以进程权限执行任意指令。 当超长字符串作为subscribe的参数提交给服务器，可导致应用程序由于缺少正确边界检查而造成缓冲区溢出，精心构建提交数据，可能以进程权限执行任意指令。 Novell NetMail 3.52 D Novell NetMail 3.52 C1 Novell NetMail 3.52 C Novell NetMail 3.52 B Novell NetMail 3.52 A...

[SECURITY] Fedora Core 5 Update: dovecot-1.0-0.beta8.3.fc5

Dovecot is an IMAP server for Linux/UNIX-like systems, written with security primarily in mind. It also contains a small POP3 server. It supports mail in either of maildir or mbox formats...

CVE-2006-6761

Stack-based buffer overflow in the IMAP daemon IMAPD in Novell NetMail before 3.52e FTF2 allows remote authenticated users to execute arbitrary code via a long argument to the SUBSCRIBE command...

CVE-2006-6761

CVE-2006-6761 describes a stack-based buffer overflow in the IMAPD of Novell NetMail prior to 3.52e FTF2 . An attacker with authenticated remote access can trigger the overflow by sending a long argument to the IMAP SUBSCRIBE command, potentially allowing arbitrary code execution on affected syst...

CVE-2006-6761

Stack-based buffer overflow in the IMAP daemon IMAPD in Novell NetMail before 3.52e FTF2 allows remote authenticated users to execute arbitrary code via a long argument to the SUBSCRIBE command...

CVE-2006-6424

Multiple buffer overflows in Novell NetMail before 3.52e FTF2 allow remote attackers to execute arbitrary code 1 by appending literals to certain IMAP verbs when specifying command continuation requests to IMAPD, resulting in a heap overflow; and 2 via crafted arguments to the STOR command to the...

CVE-2006-6425

Stack-based buffer overflow in the IMAP daemon IMAPD in Novell NetMail before 3.52e FTF2 allows remote authenticated users to execute arbitrary code via unspecified vectors involving the APPEND command...

CVE-2006-6424

Multiple buffer overflows in Novell NetMail before 3.52e FTF2 allow remote attackers to execute arbitrary code 1 by appending literals to certain IMAP verbs when specifying command continuation requests to IMAPD, resulting in a heap overflow; and 2 via crafted arguments to the STOR command to the...

CVE-2006-6425

CVE-2006-6425 describes a stack-based buffer overflow in the Novell NetMail IMAP daemon (IMAPD) when processing the APPEND command, affecting NetMail versions prior to 3.52e FTF2. An authenticated remote attacker who can access IMAP services could trigger arbitrary code execution in the IMAP serv...

CVE-2006-6424

The CVE-2006-6424 vulnerability affects Novell NetMail (NMAP STOR and IMAP handling). Affected: NetMail servers prior to 3.52e FTF2; NMAP STOR buffer overflow can yield remote code execution, and IMAP command continuation handling can cause a heap overflow. Confirmed exploitation is possible via ...

CVE-2006-6425

Stack-based buffer overflow in the IMAP daemon IMAPD in Novell NetMail before 3.52e FTF2 allows remote authenticated users to execute arbitrary code via unspecified vectors involving the APPEND command...

Novell Netmail IMAP服务APPEND命令远程栈溢出漏洞

Novell NetMail是基于Internet标准消息和安全协议的邮件和日历系统。 NetMail IMAP服务程序在处理APPEND命令时存在栈溢出漏洞，如果攻击者能够向该命令发送特定参数的话，就可以触发这个溢出，导致执行任意指令。 Novell NetMail 3.52 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： https://secure-support.novell.com/KanisaPlatform/Publishing/134/3096026f.SALPublic.html...