FreeBSD : cyrus-imapd -- multiple buffer overflow vulnerabilities (b2d248ad-88f6-11d9-aa18-0001020eed82)

The Cyrus IMAP Server ChangeLog states : - Fix possible single byte overflow in mailbox handling code. - Fix possible single byte overflows in the imapd annotate extension. - Fix stack-based buffer overflows in fetchnews exploitable by peer news server, backend exploitable by admin, and in imapd...

FreeBSD : Cyrus IMAPd -- FETCH command out of bounds memory corruption (c0a269d5-3d16-11d9-8818-008088034841)

The argument parser of the fetch command suffers a bug very similiar to the partial command problem. Arguments like 'bodyp', 'binaryp' or 'binaryp' will be wrongly detected and the bufferposition can point outside of the allocated buffer for the rest of the parsing process. When the parser trigge...

FreeBSD : Cyrus IMAPd -- IMAPMAGICPLUS preauthentification overflow (816fdd8b-3d14-11d9-8818-008088034841)

When the option imapmagicplus is activated on a server the PROXY and LOGIN commands suffer a standard stack overflow, because the username is not checked against a maximum length when it is copied into a temporary stack buffer. This bug is especially dangerous because it can be triggered before a...

FreeBSD : Cyrus IMAPd -- APPEND command uses undefined programming construct (31952117-3d17-11d9-8818-008088034841)

To support MULTIAPPENDS the cmdappend handler uses the global stage array. This array is one of the things that gets destructed when the fatal function is triggered. When the Cyrus IMAP code adds new entries to this array this is done with the help of the postfix increment operator in combination...

FreeBSD : Cyrus IMAPd -- PARTIAL command out of bounds memory corruption (114d70f3-3d16-11d9-8818-008088034841)

Due to a bug within the argument parser of the partial command an argument like 'bodyp' will be wrongly detected as 'body.peek'. Because of this the bufferposition gets increased by 10 instead of 5 and could therefore point outside the allocated memory buffer for the rest of the parsing process. ...

CVE-2002-1782

The CVE-2002-1782 entry concerns the University of Washington IMAP daemon (wu-imapd). In default configurations on systems that deny shell access, an authenticated IMAP user can read arbitrary files as that user. This is supported by multiple connected sources (OpenVAS/Nessus entries) describing ...

cyrus, perl security update

CentOS Errata and Security Advisory CESA-2005:408 Updated cyrus-imapd packages that fix several buffer overflow security issues are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The cyrus-imapd package contains the core of the...

Moderate: Red Hat Security Advisory: cyrus-imapd security update

Updated cyrus-imapd packages that fix several buffer overflow security issues are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The cyrus-imapd package contains the core of the Cyrus IMAP server. Several buffer overflow bugs we...

security flaw

Multiple buffer overflows in Cyrus IMAPd before 2.2.11 may allow attackers to execute arbitrary code via 1 an off-by-one error in the imapd annotate extension, 2 an off-by-one error in "cached header handling," 3 a stack-based buffer overflow in fetchnews, or 4 a stack-based buffer overflow in...

RHEL 4 : cyrus-imapd (RHSA-2005:408)

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2005:408 advisory. The cyrus-imapd package contains the core of the Cyrus IMAP server. Several buffer overflow bugs were found in cyrus-imapd. It is possible that an...

CVE-2005-1015

Buffer overflow in MailEnable Imapd MEIMAP.exe allows remote attackers to execute arbitrary code via a long LOGIN command...

CVE-2005-0546

Multiple buffer overflows in Cyrus IMAPd before 2.2.11 may allow attackers to execute arbitrary code via 1 an off-by-one error in the imapd annotate extension, 2 an off-by-one error in "cached header handling," 3 a stack-based buffer overflow in fetchnews, or 4 a stack-based buffer overflow in...

CVE-2005-0546

Multiple buffer overflows in Cyrus IMAPd before 2.2.11 may allow attackers to execute arbitrary code via 1 an off-by-one error in the imapd annotate extension, 2 an off-by-one error in "cached header handling," 3 a stack-based buffer overflow in fetchnews, or 4 a stack-based buffer overflow in...

CVE-2005-1015

Buffer overflow in MailEnable Imapd MEIMAP.exe allows remote attackers to execute arbitrary code via a long LOGIN command...

CVE-2005-1015

MailEnable Imapd (MEIMAP.exe) is affected by a buffer overflow vulnerability triggered by a long LOGIN command. The issue allows remote code execution and is tracked as CVE-2005-1015. Public sources (including Red Hat and NVD entries) describe the flaw as arising from a buffer overflow in the IMA...

Re: [Full-disclosure] MailEnable Imapd remote BoF + Exploit [x0n3-h4ck]

If you care at all about security, run, don't walk, away from this software. Another simple overflow via the "LOGIN" IMAP command: A001 LOGIN 1024 bytesrn -HD On Tuesday 05 April 2005 12:31, expanders wrote: -=+ Application: Mail Enable Imapd MEIMAP.exe Full-Disclosure - We believe in it. Charter...

MailEnable Enterprise 1.x Imapd Remote Exploit

Exploit for linux platform in category remote exploits ============================================== MailEnable Enterprise 1.x Imapd Remote Exploit ============================================== / +--=--------------------------x0n3-h4ck Team Presents---------------------------=--+ +--= =--+ +--=...

MailEnable Enterprise 1.x - IMAPd Remote Overflow

/ +--=--------------------------x0n3-h4ck Team Presents---------------------------=--+ +--= =--+ +--= MailEnable Enterprise include include include include include include include include include include / Connectback Shellcode ::: 316 byte Link points: Ip : 111 unsigned long xored 0x99999999 Por...

MailEnable Enterprise 1.x Imapd Remote Exploit

No description provided by source. / +--=--------------------------x0n3-h4ck Team Presents---------------------------=--+ +--= =--+ +--= MailEnable Enterprise = 1.04Professional = 1.54 remote Imapd exploit =--+ +--= =--+ +--= Bug discovered by..: Corryl [email protected] =--+ +--= Exploit coded...

MailEnable Enterprise 1.x - IMAPd Remote Overflow

MailEnable Enterprise 1.x - IMAPd Remote Overflow / +--=--------------------------x0n3-h4ck Team Presents---------------------------=--+ +--= =--+ +--= MailEnable Enterprise include include include include include include include include include include / Connectback Shellcode ::: 316 byte Link...