Published: 10/01/2005 Updated: 08/12/2016

CVSS v2 Base Score: 10 | Impact Score: 10 | Exploitability Score: 10

VMScore: 890

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

The argument parser of the FETCH command in Cyrus IMAP Server 2.2.x up to and including 2.2.8 allows remote authenticated users to execute arbitrary code via certain commands such as (1) "body[p", (2) "binary[p", or (3) "binary[p") that cause an index increment error that leads to an out-of-bounds memory corruption.

Vulnerable Product	Search on Vulmon	Subscribe to Product
carnegie mellon university cyrus imap server 2.1.7
carnegie mellon university cyrus imap server 2.1.9
carnegie mellon university cyrus imap server 2.2.7
carnegie mellon university cyrus imap server 2.2.8
carnegie mellon university cyrus imap server 2.1.10
carnegie mellon university cyrus imap server 2.1.16
carnegie mellon university cyrus imap server 2.2.5
carnegie mellon university cyrus imap server 2.2.6
carnegie mellon university cyrus imap server 2.2.2_beta
carnegie mellon university cyrus imap server 2.2.3
carnegie mellon university cyrus imap server 2.2.4
conectiva linux 9.0
carnegie mellon university cyrus imap server 2.2.0_alpha
carnegie mellon university cyrus imap server 2.2.1_beta
openpkg openpkg current
conectiva linux 10.0
trustix secure linux 2.0
trustix secure linux 2.1
redhat fedora core core_2.0
redhat fedora core core_3.0
ubuntu ubuntu linux 4.1
trustix secure linux 2.2

Stefan Esser discovered several buffer overflows in the Cyrus IMAP server Due to insufficient checking within the argument parser of the “partial” and “fetch” commands, an argument like “body[p” was detected as “bodypeek” This could cause a buffer overflow which could be exploited to execute arbitrary attacker-supplied code ...

Stefan Esser discovered several security related problems in the Cyrus IMAP daemon Due to a bug in the command parser it is possible to access memory beyond the allocated buffer in two places which could lead to the execution of arbitrary code For the stable distribution (woody) these problems have been fixed in version 1519-92 For the unstabl ...

NVD-CWE-Other http://www.debian.org/security/2004/dsa-597 http://security.e-matters.de/advisories/152004.html http://asg.web.cmu.edu/cyrus/download/imapd/changes.html http://security.gentoo.org/glsa/glsa-200411-34.xml http://secunia.com/advisories/13274/http://asg.web.cmu.edu/archive/message.php?mailbox=archive.cyrus-announce&msg=143 http://www.mandriva.com/security/advisories?name=MDKSA-2004:139 http://marc.info/?l=bugtraq&m=110123023521619&w=2 https://www.ubuntu.com/usn/usn-31-1/https://usn.ubuntu.com/31-1/https://nvd.nist.gov

CVE-2004-1013

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect