Eudora Qualcomm WorldMail 3.0 - IMAPd Remote Overflow

Eudora Qualcomm WorldMail 3.0 - IMAPd Remote Overflow !/usr/bin/python PRE AUTHENTICATION Eudora Qualcomm WorldMail 3.0 IMAPd Service 6.1.19.0 Overflow. Discovered by Tim Shelton - [email protected] Coded by [email protected] Details: SEH gets overwritten at 970 bytes in the LIS...

Eudora Qualcomm WorldMail 3.0 - 'IMAPd' Remote Overflow

!/usr/bin/python PRE AUTHENTICATION Eudora Qualcomm WorldMail 3.0 IMAPd Service 6.1.19.0 Overflow. Discovered by Tim Shelton - [email protected] Coded by [email protected] Details: SEH gets overwritten at 970 bytes in the LIST command. No space for shellcode, so 1st stage...

MailEnable IMAPD W3C Logging Buffer Overflow

This module exploits a buffer overflow in the W3C logging functionality of the MailEnable IMAPD service. Logging is not enabled by default and this exploit requires a valid username and password to exploit the flaw. MailEnable Professional version 1.6 and prior and MailEnable Enterprise version 1...

MailEnable 1.54 Pro - Universal IMAPD W3C Logging Buffer Overflow (Metasploit)

MailEnable 1.54 Pro - Universal IMAPD W3C Logging Buffer Overflow Metasploit This file is part of the Metasploit Framework and may be redistributed according to the licenses defined in the Authors field below. In the case of an unknown or missing license, this file defaults to the same license as...

FTGate4 Groupware Mail Server 4.1 - imapd Remote Buffer Overflow (PoC)

!/usr/bin/perl use IO::Socket; print "\nFTGate Imapd BufferOverrun\nLuca Ercoli [email protected]\n"; print "http://www.lucaercoli.it\n\n\n"; $host = "localhost"; $remote = IO::Socket::INET-new Proto = "tcp", PeerAddr = $host, PeerPort = "143", ; unless $remote die "Can't connect to $host" print "...

iDEFENSE Security Advisory 09.01.05: Novell NetMail IMAPD Command Continuation Request Heap Overflow

Novell NetMail IMAPD Command Continuation Request Heap Overflow iDEFENSE Security Advisory 09.01.05 www.idefense.com/application/poi/display?id=301&type=vulnerabilities September 1, 2005 I. BACKGROUND Novell NetMail is an e-mail and calendaring system that is based on Internet-standard messaging...

MDaemon 8.0.3 IMAPD CRAM-MD5 Authentication Overflow Exploit

Exploit for unknown platform in category remote exploits ============================================================ MDaemon 8.0.3 IMAPD CRAM-MD5 Authentication Overflow Exploit ============================================================ This file is part of the Metasploit Framework and may be...

GNU Mailutils imap4d 0.6 - Remote Format String

GNU Mailutils imap4d 0.6 - Remote Format String / mu-imap4dfsexp.c GNU Mailutils imap4d v0.6 remote format string exploit by CoKi Original Reference: http://www.idefense.com/application/poi/display?id=246&type=vulnerabilities coki@nosystem:/home/coki/audit$ ./mu-imap4dfsexp GNU Mailutils imap4d...

IPSwitch IMail Server <= 8.15 IMAPD Remote Root Exploit

No description provided by source. IpSwitch IMAIL Server IMAPD Remote r00t Exploit by kcope June 2005 Confidential! use IO::Socket; 316 bytes $cbsc = "\xEB\x10\x5B\x4B\x33\xC9\x66\xB9\x25\x01\x80\x34\x0B\xC2\xE2\xFA" ."\xEB\x05\xE8\xEB\xFF\xFF\xFF"...

IPSwitch IMail Server 8.15 - IMAPD Remote Code Execution

IPSwitch IMail Server 8.15 - IMAPD Remote Code Execution IpSwitch IMAIL Server IMAPD Remote r00t Exploit by kcope June 2005 Confidential! use IO::Socket; 316 bytes $cbsc = "\xEB\x10\x5B\x4B\x33\xC9\x66\xB9\x25\x01\x80\x34\x0B\xC2\xE2\xFA" ."\xEB\x05\xE8\xEB\xFF\xFF\xFF"...

IPSwitch IMail Server 8.15 - IMAPD Remote Code Execution

IpSwitch IMAIL Server IMAPD Remote r00t Exploit by kcope June 2005 Confidential! use IO::Socket; 316 bytes $cbsc = "\xEB\x10\x5B\x4B\x33\xC9\x66\xB9\x25\x01\x80\x34\x0B\xC2\xE2\xFA" ."\xEB\x05\xE8\xEB\xFF\xFF\xFF" ."\x2B\x39\xC2\xC2\xC2\x9D\xA6\x63\xF2\xC2\xC2\xC2\x49\x82\xCE\x49"...

altn-mdaemon.txt

Hello this is kcope, there are two remote vulnerabilities in the latest ALT-N MDaemon imapd product i don't know if any of them is exploitable .. the stack based buffer overflow seems promising, but it's not preauth so i didn't investigate it further. 1. Remote denial of service in AUTHENTICATE...

[Full-disclosure] ALT-N MDaemon multiple vulnerabilities

Hello this is kcope, there are two remote vulnerabilities in the latest ALT-N MDaemon imapd product i don't know if any of them is exploitable .. the stack based buffer overflow seems promising, but it's not preauth so i didn't investigate it further. 1. Remote denial of service in AUTHENTICATE...

FreeBSD : Cyrus IMAPd -- IMAPMAGICPLUS preauthentification overflow (816fdd8b-3d14-11d9-8818-008088034841)

When the option imapmagicplus is activated on a server the PROXY and LOGIN commands suffer a standard stack overflow, because the username is not checked against a maximum length when it is copied into a temporary stack buffer. This bug is especially dangerous because it can be triggered before a...

FreeBSD : Cyrus IMAPd -- FETCH command out of bounds memory corruption (c0a269d5-3d16-11d9-8818-008088034841)

The argument parser of the fetch command suffers a bug very similiar to the partial command problem. Arguments like 'bodyp', 'binaryp' or 'binaryp' will be wrongly detected and the bufferposition can point outside of the allocated buffer for the rest of the parsing process. When the parser trigge...

FreeBSD : cyrus-imapd -- multiple buffer overflow vulnerabilities (b2d248ad-88f6-11d9-aa18-0001020eed82)

The Cyrus IMAP Server ChangeLog states : - Fix possible single byte overflow in mailbox handling code. - Fix possible single byte overflows in the imapd annotate extension. - Fix stack-based buffer overflows in fetchnews exploitable by peer news server, backend exploitable by admin, and in imapd...

FreeBSD : Cyrus IMAPd -- PARTIAL command out of bounds memory corruption (114d70f3-3d16-11d9-8818-008088034841)

Due to a bug within the argument parser of the partial command an argument like 'bodyp' will be wrongly detected as 'body.peek'. Because of this the bufferposition gets increased by 10 instead of 5 and could therefore point outside the allocated memory buffer for the rest of the parsing process. ...

FreeBSD : Cyrus IMAPd -- APPEND command uses undefined programming construct (31952117-3d17-11d9-8818-008088034841)

To support MULTIAPPENDS the cmdappend handler uses the global stage array. This array is one of the things that gets destructed when the fatal function is triggered. When the Cyrus IMAP code adds new entries to this array this is done with the help of the postfix increment operator in combination...

CVE-2002-1782

The CVE-2002-1782 entry concerns the University of Washington IMAP daemon (wu-imapd). In default configurations on systems that deny shell access, an authenticated IMAP user can read arbitrary files as that user. This is supported by multiple connected sources (OpenVAS/Nessus entries) describing ...

cyrus, perl security update

CentOS Errata and Security Advisory CESA-2005:408 Updated cyrus-imapd packages that fix several buffer overflow security issues are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The cyrus-imapd package contains the core of the...