CVE-2005-2933
published 2005-10-13CVE-2005-2933: Buffer overflow in the mail_valid_net_parse_work function in mail.c for Washington's IMAP Server (UW-IMAP) before imap-2004g allows remote attackers to execute…
PriorityP341high7.5CVSS 2.0
AVNACLAuNCPIPAP
EPSS
8.46%
94.3th percentile
Buffer overflow in the mail_valid_net_parse_work function in mail.c for Washington's IMAP Server (UW-IMAP) before imap-2004g allows remote attackers to execute arbitrary code via a mailbox name containing a single double-quote (") character without a closing quote, which causes bytes after the double-quote to be copied into a buffer indefinitely.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | alpine | < uw-imap 7:2002edebian1-12 (bookworm) | uw-imap 7:2002edebian1-12 (bookworm) |
| debian | uw-imap | < uw-imap 7:2002edebian1-12 (bookworm) | uw-imap 7:2002edebian1-12 (bookworm) |
| university_of_washington | uw-imap | <= 2004f | — |
| university_of_washington | uw-imap | — | — |
| university_of_washington | uw-imap | — | — |
| university_of_washington | uw-imap | — | — |
| university_of_washington | uw-imap | — | — |
| university_of_washington | uw-imap | — | — |
| university_of_washington | uw-imap | — | — |
| university_of_washington | uw-imap | >= 0 < 7:2002edebian1-12 | 7:2002edebian1-12 |
| university_of_washington | uw-imap | >= 0 < 7:2002edebian1-12 | 7:2002edebian1-12 |
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv7.5HIGH
vendor_debian7.5LOW
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
Firefox command line URL launches multi-tabs
vendor_redhat·2008-07-15·CVSS 7.5
CVE-2008-2933 [HIGH] Firefox command line URL launches multi-tabs
Firefox command line URL launches multi-tabs
Mozilla Firefox before 2.0.0.16, and 3.x before 3.0.1, interprets '|' (pipe) characters in a command-line URI as requests to open multiple tabs, which allows remote attackers to access chrome:i URIs, or read arbitrary local files via manipulations involving a series of URIs that is not entirely handled by a vector application, as exploited in conjunction with CVE-2008-2540. NOTE: this issue exists because of an insufficient fix for CVE-2005-2267.
Red Hat
security flaw
vendor_redhat·2005-10-04·CVSS 7.5
CVE-2005-2933 [HIGH] security flaw
security flaw
Buffer overflow in the mail_valid_net_parse_work function in mail.c for Washington's IMAP Server (UW-IMAP) before imap-2004g allows remote attackers to execute arbitrary code via a mailbox name containing a single double-quote (") character without a closing quote, which causes bytes after the double-quote to be copied into a buffer indefinitely.
Debian
CVE-2005-2933: alpine - Buffer overflow in the mail_valid_net_parse_work function in mail.c for Washingt...
vendor_debian·2005·CVSS 7.5
CVE-2005-2933 [HIGH] CVE-2005-2933: alpine - Buffer overflow in the mail_valid_net_parse_work function in mail.c for Washingt...
Buffer overflow in the mail_valid_net_parse_work function in mail.c for Washington's IMAP Server (UW-IMAP) before imap-2004g allows remote attackers to execute arbitrary code via a mailbox name containing a single double-quote (") character without a closing quote, which causes bytes after the double-quote to be copied into a buffer indefinitely.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
GHSA
GHSA-g3w5-6ccf-62gj: Buffer overflow in the mail_valid_net_parse_work function in mail
ghsa_unreviewed·2022-05-03
CVE-2005-2933 [HIGH] GHSA-g3w5-6ccf-62gj: Buffer overflow in the mail_valid_net_parse_work function in mail
Buffer overflow in the mail_valid_net_parse_work function in mail.c for Washington's IMAP Server (UW-IMAP) before imap-2004g allows remote attackers to execute arbitrary code via a mailbox name containing a single double-quote (") character without a closing quote, which causes bytes after the double-quote to be copied into a buffer indefinitely.
OSV
CVE-2005-2933: Buffer overflow in the mail_valid_net_parse_work function in mail
osv·2005-10-13·CVSS 7.5
CVE-2005-2933 [HIGH] CVE-2005-2933: Buffer overflow in the mail_valid_net_parse_work function in mail
Buffer overflow in the mail_valid_net_parse_work function in mail.c for Washington's IMAP Server (UW-IMAP) before imap-2004g allows remote attackers to execute arbitrary code via a mailbox name containing a single double-quote (") character without a closing quote, which causes bytes after the double-quote to be copied into a buffer indefinitely.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2005-2933 security flaw
bugzilla·2018-08-16·CVSS 7.5
CVE-2005-2933 [HIGH] CVE-2005-2933 security flaw
CVE-2005-2933 security flaw
Flaw bug created to hold information about an old flaw we knew something about. For more details see the MITRE CVE description.
Discussion:
MITRE description:
Buffer overflow in the mail_valid_net_parse_work function in mail.c for Washington's IMAP Server (UW-IMAP) before imap-2004g allows remote attackers to execute arbitrary code via a mailbox name containing a single double-quote (") character without a closing quote, which causes bytes after the double-quote to be copied into a buffer indefinitely.
Bugzilla
CVE-2005-3388 multiple PHP issues (CVE-2006-1990 CVE-2005-3389 CVE-2005-3390)
bugzilla·2006-06-19·CVSS 4.3
CVE-2005-3388 [MEDIUM] CVE-2005-3388 multiple PHP issues (CVE-2006-1990 CVE-2005-3389 CVE-2005-3390)
CVE-2005-3388 multiple PHP issues (CVE-2006-1990 CVE-2005-3389 CVE-2005-3390)
Several security issues were found in the PHP package in Stronghold 4.0:
The wordwrap() PHP function did not properly check for integer overflow in
the way the "break" parameter was handled. An attacker who could control a
string passed to the "break" parameter could cause a heap overflow.
(CVE-2006-1990)
The phpinfo() PHP function did not properly sanitize long strings. This
could allow an attacker to perform cross-site scripting attacks against
sites that had publicly-available PHP scripts that called phpinfo().
(CVE-2006-0996)
A flaw in the way PHP registered global variables during a file upload
request was discovered. A remote attacker could submit a carefully crafted
multipart/form-data POST request tha
Bugzilla
CVE-2005-2933 imap buffer overflow
bugzilla·2006-05-03·CVSS 7.5
CVE-2005-2933 [HIGH] CVE-2005-2933 imap buffer overflow
CVE-2005-2933 imap buffer overflow
+++ This bug was initially created as a clone of Bug #169953 +++
iDEFENSE has reported a buffer overflow in the wu-imap server:
http://www.idefense.com/application/poi/display?id=313&type=vulnerabilities
An authenticated user can request a mailbox with a specially crafted name which
will overflow a buffer.
Discussion:
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.
http://rhn.redhat.com/errata/RHSA-2006-0501.html
Bugzilla
CVE-2005-2933 imap buffer overflow
bugzilla·2006-05-03·CVSS 7.5
CVE-2005-2933 [HIGH] CVE-2005-2933 imap buffer overflow
CVE-2005-2933 imap buffer overflow
+++ This bug was initially created as a clone of Bug #169953 +++
iDEFENSE has reported a buffer overflow in the wu-imap server:
http://www.idefense.com/application/poi/display?id=313&type=vulnerabilities
An authenticated user can request a mailbox with a specially crafted name which
will overflow a buffer.
Discussion:
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.
http://rhn.redhat.com/errata/RHSA-2006-0549.html
Bugzilla
CAN-2005-2933 imap buffer overflow (in libc-client)
bugzilla·2006-03-06·CVSS 7.5
[HIGH] CAN-2005-2933 imap buffer overflow (in libc-client)
CAN-2005-2933 imap buffer overflow (in libc-client)
Red Hat issued RHSA-2005:848-01 for this issue for RHEL 4. See
.
From that advisory:
"C-client is a common API for accessing mailboxes.
"A buffer overflow flaw was discovered in the way C-client parses user
supplied mailboxes. If an authenticated user requests a specially crafted
mailbox name, it may be possible to execute arbitrary code on a server that
uses C-client to access mailboxes. The Common Vulnerabilities and Exposures
project has assigned the name CVE-2005-2933 to this issue."
Also see Bug 170411 for a similar bug in imap for RHL7.3, RHL9, FC1.
+++ This bug was initially created as a clone of Bug #171345 +++
+++ This bug was initially created as a clone of Bug #171344 +++
iDEFENSE has reported a buffer overflow in the wu
Bugzilla
CVE-2005-2933 imap buffer overflow
bugzilla·2006-03-05·CVSS 7.5
CVE-2005-2933 [HIGH] CVE-2005-2933 imap buffer overflow
CVE-2005-2933 imap buffer overflow
Remote exploitation of a buffer overflow vulnerability in the University
of Washington's IMAP Server (UW-IMAP) allows attackers to execute
arbitrary code. (quote from iDefense advisory, see
http://www.idefense.com/intelligence/vulnerabilities/display.php?type=vulnerabilities&id=313)
All versions of imap < imap-2004g are affected. This includes RHL 7.3, RHL 9,
and probably most FC versions.
RH used the following patch to fix the issue in RHEL 2.1:
--snip--
Fix for CAN-2005-2933, from iDefense's advisory.
diff -uNr imap-2001a/src/c-client/mail.c imap-2004g/src/c-client/mail.c
--- imap-2001a/src/c-client/mail.c 2001-11-13 14:29:07.000000000 -0500
+++ imap-2004g/src/c-client/mail.c 2005-09-15 12:57:07.000000000 -0400
@@ -587,8 +587,10 @@
if (c == '=') { /
Bugzilla
CVE-2002-2214 PHP segfault imap_fetch_overview() (CVE-2002-2215, CVE-2003-1302, CVE-2003-1303). Also - Multiple PHP vulnerabilities (CVE-2005-2933 CVE-2005-3883 CVE-2006-0208 CVE-2006-0996 CVE-2006-1
bugzilla·2005-12-05·CVSS 5.0
CVE-2002-2214 [MEDIUM] CVE-2002-2214 PHP segfault imap_fetch_overview() (CVE-2002-2215, CVE-2003-1302, CVE-2003-1303). Also - Multiple PHP vulnerabilities (CVE-2005-2933 CVE-2005-3883 CVE-2006-0208 CVE-2006-0996 CVE-2006-1
CVE-2002-2214 PHP segfault imap_fetch_overview() (CVE-2002-2215, CVE-2003-1302, CVE-2003-1303). Also - Multiple PHP vulnerabilities (CVE-2005-2933 CVE-2005-3883 CVE-2006-0208 CVE-2006-0996 CVE-2006-1490 CVE-2006-1990)
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20051012 Netscape/8.0.4
Description of problem:
If a mailbox contains a From: or To: header beginning with an overlong e-mail address, imap_fetch_overview() will segfault when processing that message.
This is one of several vulnerabilities where code in php_imap.c calls rfc822_write_address() to write an e-mail address to a buffer of fixed size without first checking that the e-mail address fits into the buffer.
http://bugs.php.net/bug.php?id=15595
http://bugs.php.net/bug.php
Bugzilla
CVE-2005-2933 imap buffer overflow
bugzilla·2005-11-29·CVSS 7.5
CVE-2005-2933 [HIGH] CVE-2005-2933 imap buffer overflow
CVE-2005-2933 imap buffer overflow
+++ This bug was initially created as a clone of Bug #169953 +++
iDEFENSE has reported a buffer overflow in the wu-imap server:
http://www.idefense.com/application/poi/display?id=313&type=vulnerabilities
An authenticated user can request a mailbox with a specially crafted name which
will overflow a buffer.
This issue also affects RHEL2.1
Discussion:
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.
http://rhn.redhat.com/errata/RHSA-2006-0276.html
Bugzilla
CVE-2005-2933 imap buffer overflow
bugzilla·2005-10-20·CVSS 7.5
CVE-2005-2933 [HIGH] CVE-2005-2933 imap buffer overflow
CVE-2005-2933 imap buffer overflow
+++ This bug was initially created as a clone of Bug #169953 +++
iDEFENSE has reported a buffer overflow in the wu-imap server:
http://www.idefense.com/application/poi/display?id=313&type=vulnerabilities
An authenticated user can request a mailbox with a specially crafted name which
will overflow a buffer.
Discussion:
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.
http://rhn.redhat.com/errata/RHSA-2005-848.html
Bugzilla
CAN-2005-2933 University of Washington IMAP Mailbox Name Buffer Overflow
bugzilla·2005-10-11
[MEDIUM] CAN-2005-2933 University of Washington IMAP Mailbox Name Buffer Overflow
CAN-2005-2933 University of Washington IMAP Mailbox Name Buffer Overflow
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20050729 Netscape/8.0.3.3
Description of problem:
05.40.14 CVE: CAN-2005-2933
Platform: Cross Platform
Title: University of Washington IMAP Mailbox Name Buffer Overflow
Description: University of Washington IMAP is prone to a buffer
overflow vulnerability due to insufficient parsing of mailbox names in
the "mail_valid_net_parse_work()" function, which is found in the
"src/c-client/mail.c" source file. University of Washington IMAP
versions 2004f and earlier are vulnerable.
Ref:
http://www.idefense.com/application/poi/display?id=313&type=vulnerabilities&flashstatus=true
Version-Release number of selected component (if a
Bugzilla
CVE-2005-2933 imap buffer overflow
bugzilla·2005-10-05·CVSS 7.5
CVE-2005-2933 [HIGH] CVE-2005-2933 imap buffer overflow
CVE-2005-2933 imap buffer overflow
iDEFENSE has reported a buffer overflow in the wu-imap server:
http://www.idefense.com/application/poi/display?id=313&type=vulnerabilities
An authenticated user can request a mailbox with a specially crafted name which
will overflow a buffer.
Discussion:
This issue also affects RHEL2.1
---
Ping on this issue.
---
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.
http://rhn.redhat.com/errata/RHSA-2005-850.html
ftp://patches.sgi.com/support/free/security/advisories/20051201-01-Uftp://patches.sgi.com/support/free/security/advisories/20060501-01-U.aschttp://archives.neohapsis.com/archives/fulldisclosure/2005-10/0081.htmlhttp://rhn.redhat.com/errata/RHSA-2006-0276.htmlhttp://rhn.redhat.com/errata/RHSA-2006-0549.htmlhttp://secunia.com/advisories/17062/http://secunia.com/advisories/17148http://secunia.com/advisories/17152http://secunia.com/advisories/17215http://secunia.com/advisories/17276http://secunia.com/advisories/17336http://secunia.com/advisories/17483http://secunia.com/advisories/17928http://secunia.com/advisories/17930http://secunia.com/advisories/17950http://secunia.com/advisories/18554http://secunia.com/advisories/19832http://secunia.com/advisories/20210http://secunia.com/advisories/20222http://secunia.com/advisories/20951http://secunia.com/advisories/21252http://secunia.com/advisories/21564http://securityreason.com/securityalert/47http://securitytracker.com/id?1015000http://slackware.com/security/viewer.php?l=slackware-security&y=2005&m=slackware-security.500161http://support.avaya.com/elmodocs2/security/ASA-2006-129.htmhttp://support.avaya.com/elmodocs2/security/ASA-2006-160.htmhttp://www.debian.org/security/2005/dsa-861http://www.gentoo.org/security/en/glsa/glsa-200510-10.xmlhttp://www.idefense.com/application/poi/display?id=313&type=vulnerabilities&flashstatus=truehttp://www.kb.cert.org/vuls/id/933601http://www.mandriva.com/security/advisories?name=MDKSA-2005:189http://www.mandriva.com/security/advisories?name=MDKSA-2005:194http://www.novell.com/linux/security/advisories/2005_23_sr.htmlhttp://www.redhat.com/support/errata/RHSA-2005-848.htmlhttp://www.redhat.com/support/errata/RHSA-2005-850.htmlhttp://www.redhat.com/support/errata/RHSA-2006-0501.htmlhttp://www.securityfocus.com/archive/1/430296/100/0/threadedhttp://www.securityfocus.com/archive/1/430303/100/0/threadedhttp://www.securityfocus.com/bid/15009http://www.vupen.com/english/advisories/2006/2685http://www.washington.edu/imap/https://exchange.xforce.ibmcloud.com/vulnerabilities/22518https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9858ftp://patches.sgi.com/support/free/security/advisories/20051201-01-Uftp://patches.sgi.com/support/free/security/advisories/20060501-01-U.aschttp://archives.neohapsis.com/archives/fulldisclosure/2005-10/0081.htmlhttp://rhn.redhat.com/errata/RHSA-2006-0276.htmlhttp://rhn.redhat.com/errata/RHSA-2006-0549.htmlhttp://secunia.com/advisories/17062/http://secunia.com/advisories/17148http://secunia.com/advisories/17152http://secunia.com/advisories/17215http://secunia.com/advisories/17276http://secunia.com/advisories/17336http://secunia.com/advisories/17483http://secunia.com/advisories/17928http://secunia.com/advisories/17930http://secunia.com/advisories/17950http://secunia.com/advisories/18554http://secunia.com/advisories/19832http://secunia.com/advisories/20210http://secunia.com/advisories/20222http://secunia.com/advisories/20951http://secunia.com/advisories/21252http://secunia.com/advisories/21564http://securityreason.com/securityalert/47http://securitytracker.com/id?1015000http://slackware.com/security/viewer.php?l=slackware-security&y=2005&m=slackware-security.500161http://support.avaya.com/elmodocs2/security/ASA-2006-129.htmhttp://support.avaya.com/elmodocs2/security/ASA-2006-160.htmhttp://www.debian.org/security/2005/dsa-861http://www.gentoo.org/security/en/glsa/glsa-200510-10.xmlhttp://www.idefense.com/application/poi/display?id=313&type=vulnerabilities&flashstatus=truehttp://www.kb.cert.org/vuls/id/933601http://www.mandriva.com/security/advisories?name=MDKSA-2005:189http://www.mandriva.com/security/advisories?name=MDKSA-2005:194http://www.novell.com/linux/security/advisories/2005_23_sr.htmlhttp://www.redhat.com/support/errata/RHSA-2005-848.htmlhttp://www.redhat.com/support/errata/RHSA-2005-850.htmlhttp://www.redhat.com/support/errata/RHSA-2006-0501.htmlhttp://www.securityfocus.com/archive/1/430296/100/0/threadedhttp://www.securityfocus.com/archive/1/430303/100/0/threadedhttp://www.securityfocus.com/bid/15009http://www.vupen.com/english/advisories/2006/2685http://www.washington.edu/imap/https://exchange.xforce.ibmcloud.com/vulnerabilities/22518https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9858
2005-10-13
Published