Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2008-5005

Multiple stack-based buffer overflows in (1) University of Washington IMAP Toolkit 2002 through 2007c, (2) University of Washington Alpine 2.00 and earlier, and (3) Panda IMAP allow (a) local users to gain privileges by specifying a long folder extension argument on the command line to the tmail or dmail program; and (b) remote attackers to execute arbitrary code by sending e-mail to a destination mailbox name composed of a username and '+' character followed by a long string, processed by the tmail or possibly dmail program.

Published

2008-11-10T14:12:56.140

Last Modified

2025-04-09T00:30:58.490

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 10.0 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: COMPLETE
  • Integrity Impact: COMPLETE
  • Availability Impact: COMPLETE
Exploitability Score

10.0

Impact Score

10.0

Weaknesses
  • Type: Primary
    CWE-119
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application university_of_washington alpine 0.80 Yes
Application university_of_washington alpine 0.81 Yes
Application university_of_washington alpine 0.82 Yes
Application university_of_washington alpine 0.83 Yes
Application university_of_washington alpine 0.98 Yes
Application university_of_washington alpine 0.99 Yes
Application university_of_washington alpine 0.999 Yes
Application university_of_washington alpine 0.9999 Yes
Application university_of_washington alpine 0.99999 Yes
Application university_of_washington alpine 0.999999 Yes
Application university_of_washington alpine 1.00 Yes
Application university_of_washington alpine 1.10 Yes
Application university_of_washington alpine 2.00 Yes
Application university_of_washington imap_toolkit 2002 Yes
Application university_of_washington imap_toolkit 2003 Yes
Application university_of_washington imap_toolkit 2004 Yes
Application university_of_washington imap_toolkit 2005 Yes
Application university_of_washington imap_toolkit 2006 Yes
Application university_of_washington imap_toolkit 2007 Yes
Application university_of_washington imap_toolkit 2007c Yes
References