cbcvebase.
CVE-2010-4711
published 2011-01-31

CVE-2010-4711: Double free vulnerability in the IMAP server component in GroupWise Internet Agent (GWIA) in Novell GroupWise before 8.02HP allows remote attackers to execute…

PriorityP264critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
13.59%
96.0th percentile
Double free vulnerability in the IMAP server component in GroupWise Internet Agent (GWIA) in Novell GroupWise before 8.02HP allows remote attackers to execute arbitrary code via a large parameter in a LIST command.

Affected

23 ranges
VendorProductVersion rangeFixed in
novellgroupwise<= 8.0.2—
novellgroupwise——
novellgroupwise——
novellgroupwise——
novellgroupwise——
novellgroupwise——
novellgroupwise——
novellgroupwise——
novellgroupwise——
novellgroupwise——
novellgroupwise——
novellgroupwise——
novellgroupwise——
novellgroupwise——
novellgroupwise——
novellgroupwise——
novellgroupwise——
novellgroupwise——
novellgroupwise——
novellgroupwise——
novellgroupwise——
novellgroupwise——
novellgroupwise——

Detection & IOCsextracted from sources · hover to see the quote

  • →Detect oversized IMAP LIST/SUBSCRIBE command parameters (56000+ bytes) sent to TCP port 143, indicative of exploitation of the double-free vulnerability in Novell GWIA. ↗
  • →Authentication is not required to exploit this vulnerability — monitor for unauthenticated or anomalous IMAP sessions sending large SUBSCRIBE/LIST payloads. ↗
  • →Target process is the Novell GroupWise Internet Agent (GWIA) IMAP server component; monitor for abnormal memory faults or crashes in the GWIA process following receipt of large IMAP commands. ↗
  • ·The exploit targets Novell GroupWise versions before 8.02HP; ensure patched versions are confirmed before relying solely on detection. ↗
  • ·The proof-of-concept uses a hardcoded target IP (192.168.100.177) and connects to port 143; real-world attacks may vary the target IP but the port and oversized payload pattern remain consistent indicators. ↗
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.