CVE-2010-2777

published 2011-01-28

CVE-2010-2777: Stack-based buffer overflow in the IMAP server component in GroupWise Internet Agent (GWIA) in Novell GroupWise 7.x before 7.0 post-SP4 FTF and 8.x before 8.0…

Priority P2 60 critical 9 CVSS 2.0

AV N AC L Au S C C I C A C

EXPLOIT

Stack-based buffer overflow in the IMAP server component in GroupWise Internet Agent (GWIA) in Novell GroupWise 7.x before 7.0 post-SP4 FTF and 8.x before 8.0 SP2 allows remote attackers to execute arbitrary code via a long mailbox name in a CREATE command.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
novell	groupwise	—	—
novell	groupwise	—	—

Detection & IOCs extracted from sources · hover to see the quote

port 143↗

command A001 CREATE <long mailbox name>↗

bytes↗

\x41 * 532

• → Detect oversized IMAP CREATE command mailbox name arguments (532+ bytes) sent to GWIA IMAP service on port 143, indicative of stack buffer overflow exploitation attempt. ↗
• → Authentication is required prior to exploitation; monitor for LOGIN commands followed immediately by a CREATE command with an abnormally long argument from the same session. ↗
• → Monitor GWIA IMAP service (port 143) for CREATE commands with mailbox name arguments exceeding normal length thresholds, particularly on Novell GroupWise 7.x and 8.x deployments. ↗

• · Affected platforms include Windows, Linux, and Netware running GroupWise versions 7.0, 7.01, 7.02, 7.03x, 7.04, 8.0, and 8.01x. Ensure detection coverage spans all three OS platforms. ↗
• · Exploitation requires valid IMAP authentication credentials before the CREATE overflow can be triggered; unauthenticated probes alone are not sufficient for exploitation. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-119