CVE-2005-1758

published 2005-06-08

CVE-2005-1758: Buffer overflow in the IMAP command continuation function in Novell NetMail 3.52 before 3.52C may allow remote attackers to execute arbitrary code.

Priority P3 45 high 7.5 CVSS 2.0

AV N AC L Au N C P I P A P

EXPLOIT

Buffer overflow in the IMAP command continuation function in Novell NetMail 3.52 before 3.52C may allow remote attackers to execute arbitrary code.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
novell	netmail	—	—
novell	netmail	—	—
novell	netmail	—	—
novell	netmail	—	—

Detection & IOCs extracted from sources · hover to see the quote

command AUTHENTICATE GSSAPI↗

port 143↗

• → Monitor IMAP sessions for abnormally long strings sent as part of the AUTHENTICATE GSSAPI continuation sequence, which may indicate exploitation of the stack buffer overflow. ↗
• → Reliable post-exploitation payloads observed in the wild for this CVE include windows/shell_bind_tcp and windows/shell_reverse_tcp; watch for unexpected outbound or inbound shell connections from the NetMail IMAP process. ↗

• · The vulnerability affects Novell NetMail 3.52 versions prior to 3.52C only; patched versions (3.52C and later) are not affected. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.