cbcvebase.
CVE-2005-3314
published 2005-11-18

CVE-2005-3314: Stack-based buffer overflow in the IMAP daemon in Novell Netmail 3.5.2 allows remote attackers to execute arbitrary code via "long verb arguments."

PriorityP258high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
65.66%
99.2th percentile
Stack-based buffer overflow in the IMAP daemon in Novell Netmail 3.5.2 allows remote attackers to execute arbitrary code via "long verb arguments."

Affected

1 ranges
VendorProductVersion rangeFixed in
novellnetmail——

Detection & IOCsextracted from sources · hover to see the quote

commanda002 STATUS <1602 random bytes><payload>\xeb\x06<2 random bytes><ret> inbox↗
other0x75022ac4↗
port143↗
  • →Detect oversized IMAP STATUS command arguments — the exploit sends a STATUS verb followed by a ~1602+ byte argument string, far exceeding normal usage. ↗
  • →Look for a short JMP (0xEB 0x06) sequence immediately after the overflow payload body, characteristic of this exploit's NOP-sled/redirect stub. ↗
  • →The exploit targets the IMAP STATUS verb specifically; anomalous STATUS commands with arguments exceeding ~1600 bytes on port 143 should be alerted on. ↗
  • →Bad characters in payload are null byte, LF, CR, and space (0x00, 0x0a, 0x0d, 0x20); shellcode in exploit traffic will not contain these bytes, which can help distinguish exploit payloads from benign data. ↗
  • →The exploit uses EXITFUNC=thread, indicating the shellcode spawns a thread rather than exiting the process — post-exploitation process monitoring should account for unexpected threads in the IMAP daemon process. ↗
  • ·The return address 0x75022ac4 is specific to Windows 2000 SP0–SP4 English; the exploit will not reliably work against other OS versions or locales without a different return address. ↗
  • ·Payload space is constrained to 500 bytes with a stack adjustment of -3500; payloads larger than 500 bytes will not fit within the exploit's buffer layout. ↗
  • ·The exploit requires valid IMAP credentials (connect_login) before sending the malicious STATUS command; unauthenticated exploitation is not demonstrated in this module. ↗
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.