CVE-2005-1523 - Format string vulnerability in imap4d server in GNU Mailutils 0.5 and 0.6, and other versions before

CVE-2005-1523

Summary

Format string vulnerability in imap4d server in GNU Mailutils 0.5 and 0.6, and other versions before 0.6.90, allows remote attackers to execute arbitrary code via format string specifiers in the command tag for IMAP commands.

References

http://secunia.com/advisories/15442
http://securitytracker.com/id?1014052
http://www.debian.org/security/2005/dsa-732
http://www.idefense.com/application/poi/display?id=246&type=vulnerabilities
http://www.securityfocus.com/bid/13764

Vulnerable Configurations

cpe:2.3:a:gnu:mailutils:0.5:*:*:*:*:*:*:*
cpe:2.3:a:gnu:mailutils:0.5:*:*:*:*:*:*:*
cpe:2.3:a:gnu:mailutils:0.6:*:*:*:*:*:*:*
cpe:2.3:a:gnu:mailutils:0.6:*:*:*:*:*:*:*

CVSS

Base:	7.5 (as of 05-09-2008 - 20:49)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:L/Au:N/C:P/I:P/A:P

refmap via4

bid	13764
debian	DSA-732
idefense	20050525 GNU Mailutils 0.6 imap4d Format String Vulnerability
sectrack	1014052
secunia	15442

Last major update

05-09-2008 - 20:49

Published

26-05-2005 - 04:00

Last modified

05-09-2008 - 20:49