CVE-2008-5005
Vulnerability from cvelistv5
Published
2008-11-10 11:00
Modified
2024-08-07 10:40
Severity ?
Summary
Multiple stack-based buffer overflows in (1) University of Washington IMAP Toolkit 2002 through 2007c, (2) University of Washington Alpine 2.00 and earlier, and (3) Panda IMAP allow (a) local users to gain privileges by specifying a long folder extension argument on the command line to the tmail or dmail program; and (b) remote attackers to execute arbitrary code by sending e-mail to a destination mailbox name composed of a username and '+' character followed by a long string, processed by the tmail or possibly dmail program.
References
cve@mitre.orghttp://mailman2.u.washington.edu/pipermail/imap-uw/2008-October/002267.htmlPatch
cve@mitre.orghttp://mailman2.u.washington.edu/pipermail/imap-uw/2008-October/002268.html
cve@mitre.orghttp://marc.info/?l=full-disclosure&m=122572590212610&w=4
cve@mitre.orghttp://panda.com/imap/
cve@mitre.orghttp://rhn.redhat.com/errata/RHSA-2009-0275.html
cve@mitre.orghttp://secunia.com/advisories/32483Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/32512
cve@mitre.orghttp://secunia.com/advisories/33142
cve@mitre.orghttp://secunia.com/advisories/33996
cve@mitre.orghttp://securityreason.com/securityalert/4570
cve@mitre.orghttp://securitytracker.com/id?1021131
cve@mitre.orghttp://support.avaya.com/elmodocs2/security/ASA-2009-065.htm
cve@mitre.orghttp://www.bitsec.com/en/rad/bsa-081103.cURL Repurposed
cve@mitre.orghttp://www.bitsec.com/en/rad/bsa-081103.txtURL Repurposed
cve@mitre.orghttp://www.debian.org/security/2008/dsa-1685
cve@mitre.orghttp://www.mandriva.com/security/advisories?name=MDVSA-2009:146
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2008/11/03/3
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2008/11/03/4
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2008/11/03/5
cve@mitre.orghttp://www.securityfocus.com/archive/1/498002/100/0/threaded
cve@mitre.orghttp://www.securityfocus.com/bid/32072
cve@mitre.orghttp://www.vupen.com/english/advisories/2008/3042
cve@mitre.orghttp://www.washington.edu/alpine/tmailbug.html
cve@mitre.orghttps://bugzilla.redhat.com/show_bug.cgi?id=469667Patch
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/46281
cve@mitre.orghttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10485
cve@mitre.orghttps://www.redhat.com/archives/fedora-package-announce/2008-November/msg00058.html
cve@mitre.orghttps://www.redhat.com/archives/fedora-package-announce/2008-November/msg00082.html
af854a3a-2127-422b-91ae-364da2661108http://mailman2.u.washington.edu/pipermail/imap-uw/2008-October/002267.htmlPatch
af854a3a-2127-422b-91ae-364da2661108http://mailman2.u.washington.edu/pipermail/imap-uw/2008-October/002268.html
af854a3a-2127-422b-91ae-364da2661108http://marc.info/?l=full-disclosure&m=122572590212610&w=4
af854a3a-2127-422b-91ae-364da2661108http://panda.com/imap/
af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2009-0275.html
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/32483Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/32512
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/33142
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/33996
af854a3a-2127-422b-91ae-364da2661108http://securityreason.com/securityalert/4570
af854a3a-2127-422b-91ae-364da2661108http://securitytracker.com/id?1021131
af854a3a-2127-422b-91ae-364da2661108http://support.avaya.com/elmodocs2/security/ASA-2009-065.htm
af854a3a-2127-422b-91ae-364da2661108http://www.bitsec.com/en/rad/bsa-081103.cURL Repurposed
af854a3a-2127-422b-91ae-364da2661108http://www.bitsec.com/en/rad/bsa-081103.txtURL Repurposed
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2008/dsa-1685
af854a3a-2127-422b-91ae-364da2661108http://www.mandriva.com/security/advisories?name=MDVSA-2009:146
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2008/11/03/3
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2008/11/03/4
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2008/11/03/5
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/498002/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/32072
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2008/3042
af854a3a-2127-422b-91ae-364da2661108http://www.washington.edu/alpine/tmailbug.html
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=469667Patch
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/46281
af854a3a-2127-422b-91ae-364da2661108https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10485
af854a3a-2127-422b-91ae-364da2661108https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00058.html
af854a3a-2127-422b-91ae-364da2661108https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00082.html
Impacted products
Vendor Product Version
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T10:40:16.768Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "oval:org.mitre.oval:def:10485",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10485"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://panda.com/imap/"
          },
          {
            "name": "[oss-security] 20081103 CVE request - uw-imap",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2008/11/03/3"
          },
          {
            "name": "FEDORA-2008-9396",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00082.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.bitsec.com/en/rad/bsa-081103.txt"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.bitsec.com/en/rad/bsa-081103.c"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.avaya.com/elmodocs2/security/ASA-2009-065.htm"
          },
          {
            "name": "[oss-security] 20081103 Re: CVE request - uw-imap",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2008/11/03/5"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.washington.edu/alpine/tmailbug.html"
          },
          {
            "name": "4570",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/4570"
          },
          {
            "name": "20081103 Bitsec Security Advisory: UW/Panda IMAP [dt]mail buffer overflow",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/498002/100/0/threaded"
          },
          {
            "name": "[imap-uw] 20081031 Security bug in tmail and dmail",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://mailman2.u.washington.edu/pipermail/imap-uw/2008-October/002268.html"
          },
          {
            "name": "DSA-1685",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2008/dsa-1685"
          },
          {
            "name": "32483",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/32483"
          },
          {
            "name": "32072",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/32072"
          },
          {
            "name": "uwimapd-tmail-bo(46281)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46281"
          },
          {
            "name": "33142",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/33142"
          },
          {
            "name": "FEDORA-2008-9383",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00058.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=469667"
          },
          {
            "name": "RHSA-2009:0275",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2009-0275.html"
          },
          {
            "name": "20081103 Bitsec Security Advisory: UW/Panda IMAP [dt]mail buffer overflow",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=full-disclosure\u0026m=122572590212610\u0026w=4"
          },
          {
            "name": "[imap-uw] 20081031 Security bug in tmail and dmail",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://mailman2.u.washington.edu/pipermail/imap-uw/2008-October/002267.html"
          },
          {
            "name": "33996",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/33996"
          },
          {
            "name": "MDVSA-2009:146",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:146"
          },
          {
            "name": "32512",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/32512"
          },
          {
            "name": "[oss-security] 20081103 Re: CVE request - uw-imap",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2008/11/03/4"
          },
          {
            "name": "ADV-2008-3042",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2008/3042"
          },
          {
            "name": "1021131",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://securitytracker.com/id?1021131"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2008-11-03T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple stack-based buffer overflows in (1) University of Washington IMAP Toolkit 2002 through 2007c, (2) University of Washington Alpine 2.00 and earlier, and (3) Panda IMAP allow (a) local users to gain privileges by specifying a long folder extension argument on the command line to the tmail or dmail program; and (b) remote attackers to execute arbitrary code by sending e-mail to a destination mailbox name composed of a username and \u0027+\u0027 character followed by a long string, processed by the tmail or possibly dmail program."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-11T19:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "oval:org.mitre.oval:def:10485",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10485"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://panda.com/imap/"
        },
        {
          "name": "[oss-security] 20081103 CVE request - uw-imap",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2008/11/03/3"
        },
        {
          "name": "FEDORA-2008-9396",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00082.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.bitsec.com/en/rad/bsa-081103.txt"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.bitsec.com/en/rad/bsa-081103.c"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.avaya.com/elmodocs2/security/ASA-2009-065.htm"
        },
        {
          "name": "[oss-security] 20081103 Re: CVE request - uw-imap",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2008/11/03/5"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.washington.edu/alpine/tmailbug.html"
        },
        {
          "name": "4570",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/4570"
        },
        {
          "name": "20081103 Bitsec Security Advisory: UW/Panda IMAP [dt]mail buffer overflow",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/498002/100/0/threaded"
        },
        {
          "name": "[imap-uw] 20081031 Security bug in tmail and dmail",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://mailman2.u.washington.edu/pipermail/imap-uw/2008-October/002268.html"
        },
        {
          "name": "DSA-1685",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2008/dsa-1685"
        },
        {
          "name": "32483",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/32483"
        },
        {
          "name": "32072",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/32072"
        },
        {
          "name": "uwimapd-tmail-bo(46281)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46281"
        },
        {
          "name": "33142",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/33142"
        },
        {
          "name": "FEDORA-2008-9383",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00058.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=469667"
        },
        {
          "name": "RHSA-2009:0275",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2009-0275.html"
        },
        {
          "name": "20081103 Bitsec Security Advisory: UW/Panda IMAP [dt]mail buffer overflow",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://marc.info/?l=full-disclosure\u0026m=122572590212610\u0026w=4"
        },
        {
          "name": "[imap-uw] 20081031 Security bug in tmail and dmail",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://mailman2.u.washington.edu/pipermail/imap-uw/2008-October/002267.html"
        },
        {
          "name": "33996",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/33996"
        },
        {
          "name": "MDVSA-2009:146",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:146"
        },
        {
          "name": "32512",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/32512"
        },
        {
          "name": "[oss-security] 20081103 Re: CVE request - uw-imap",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2008/11/03/4"
        },
        {
          "name": "ADV-2008-3042",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2008/3042"
        },
        {
          "name": "1021131",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://securitytracker.com/id?1021131"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2008-5005",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple stack-based buffer overflows in (1) University of Washington IMAP Toolkit 2002 through 2007c, (2) University of Washington Alpine 2.00 and earlier, and (3) Panda IMAP allow (a) local users to gain privileges by specifying a long folder extension argument on the command line to the tmail or dmail program; and (b) remote attackers to execute arbitrary code by sending e-mail to a destination mailbox name composed of a username and \u0027+\u0027 character followed by a long string, processed by the tmail or possibly dmail program."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "oval:org.mitre.oval:def:10485",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10485"
            },
            {
              "name": "http://panda.com/imap/",
              "refsource": "CONFIRM",
              "url": "http://panda.com/imap/"
            },
            {
              "name": "[oss-security] 20081103 CVE request - uw-imap",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2008/11/03/3"
            },
            {
              "name": "FEDORA-2008-9396",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00082.html"
            },
            {
              "name": "http://www.bitsec.com/en/rad/bsa-081103.txt",
              "refsource": "MISC",
              "url": "http://www.bitsec.com/en/rad/bsa-081103.txt"
            },
            {
              "name": "http://www.bitsec.com/en/rad/bsa-081103.c",
              "refsource": "MISC",
              "url": "http://www.bitsec.com/en/rad/bsa-081103.c"
            },
            {
              "name": "http://support.avaya.com/elmodocs2/security/ASA-2009-065.htm",
              "refsource": "CONFIRM",
              "url": "http://support.avaya.com/elmodocs2/security/ASA-2009-065.htm"
            },
            {
              "name": "[oss-security] 20081103 Re: CVE request - uw-imap",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2008/11/03/5"
            },
            {
              "name": "http://www.washington.edu/alpine/tmailbug.html",
              "refsource": "MISC",
              "url": "http://www.washington.edu/alpine/tmailbug.html"
            },
            {
              "name": "4570",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/4570"
            },
            {
              "name": "20081103 Bitsec Security Advisory: UW/Panda IMAP [dt]mail buffer overflow",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/498002/100/0/threaded"
            },
            {
              "name": "[imap-uw] 20081031 Security bug in tmail and dmail",
              "refsource": "MLIST",
              "url": "http://mailman2.u.washington.edu/pipermail/imap-uw/2008-October/002268.html"
            },
            {
              "name": "DSA-1685",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2008/dsa-1685"
            },
            {
              "name": "32483",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/32483"
            },
            {
              "name": "32072",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/32072"
            },
            {
              "name": "uwimapd-tmail-bo(46281)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46281"
            },
            {
              "name": "33142",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/33142"
            },
            {
              "name": "FEDORA-2008-9383",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00058.html"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=469667",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=469667"
            },
            {
              "name": "RHSA-2009:0275",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2009-0275.html"
            },
            {
              "name": "20081103 Bitsec Security Advisory: UW/Panda IMAP [dt]mail buffer overflow",
              "refsource": "FULLDISC",
              "url": "http://marc.info/?l=full-disclosure\u0026m=122572590212610\u0026w=4"
            },
            {
              "name": "[imap-uw] 20081031 Security bug in tmail and dmail",
              "refsource": "MLIST",
              "url": "http://mailman2.u.washington.edu/pipermail/imap-uw/2008-October/002267.html"
            },
            {
              "name": "33996",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/33996"
            },
            {
              "name": "MDVSA-2009:146",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:146"
            },
            {
              "name": "32512",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/32512"
            },
            {
              "name": "[oss-security] 20081103 Re: CVE request - uw-imap",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2008/11/03/4"
            },
            {
              "name": "ADV-2008-3042",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2008/3042"
            },
            {
              "name": "1021131",
              "refsource": "SECTRACK",
              "url": "http://securitytracker.com/id?1021131"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2008-5005",
    "datePublished": "2008-11-10T11:00:00",
    "dateReserved": "2008-11-10T00:00:00",
    "dateUpdated": "2024-08-07T10:40:16.768Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2008-5005\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2008-11-10T14:12:56.140\",\"lastModified\":\"2024-11-21T00:53:03.163\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Multiple stack-based buffer overflows in (1) University of Washington IMAP Toolkit 2002 through 2007c, (2) University of Washington Alpine 2.00 and earlier, and (3) Panda IMAP allow (a) local users to gain privileges by specifying a long folder extension argument on the command line to the tmail or dmail program; and (b) remote attackers to execute arbitrary code by sending e-mail to a destination mailbox name composed of a username and \u0027+\u0027 character followed by a long string, processed by the tmail or possibly dmail program.\"},{\"lang\":\"es\",\"value\":\"M\u00faltiples desbordamientos de b\u00fafer basados en pila en (1) University de Washington IMAP Toolkit 2002 hasta 2007c, (2) University de Washington Alpine 2.00 y versiones anteriores, y (3) Panda IMAP permiten (a) a usuarios locales conseguir privilegios mediante la especificaci\u00f3n de un argumento de extensi\u00f3n de carpeta largo en la l\u00ednea de comandos del programa tmail o dmail; y (b) a atacantes remotos ejecutar c\u00f3digo de su elecci\u00f3n mediante el env\u00edo de correos al nombre del buz\u00f3n de destino compuesto de un nombre de usuario y el car\u00e1cter \\\"+\\\" seguido de una cadena larga, procesado por tmail o posiblemente el programa dmail.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:C/I:C/A:C\",\"baseScore\":10.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"COMPLETE\",\"availabilityImpact\":\"COMPLETE\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":10.0,\"acInsufInfo\":false,\"obtainAllPrivilege\":true,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-119\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:university_of_washington:alpine:0.80:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A0AABD8C-5588-4572-BD80-5EB75C53DBC1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:university_of_washington:alpine:0.81:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F8341CA0-2A2A-4B6C-923C-2D716FC0D7BF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:university_of_washington:alpine:0.82:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7A44A344-A73C-458C-8F1F-46C15C3FC4FA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:university_of_washington:alpine:0.83:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CA7A24B7-7CA9-448A-872F-22C98DEF17DA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:university_of_washington:alpine:0.98:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"31D22762-CFCA-4504-A14D-EE45CB85D300\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:university_of_washington:alpine:0.99:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"106D7FE0-8BA1-4864-9551-4D8E03DECC21\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:university_of_washington:alpine:0.999:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9F7EB8DC-BF04-429F-B2E5-B0F441CA22EC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:university_of_washington:alpine:0.9999:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"581CCD53-DFE9-4420-B81F-40A20EB7ECA8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:university_of_washington:alpine:0.99999:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"998277B4-511E-4601-9004-C911B3E10812\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:university_of_washington:alpine:0.999999:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8EA3B059-4C46-4ED7-A915-2FE0B6256C38\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:university_of_washington:alpine:1.00:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"543690FB-F984-4170-AE1F-25FBD1E0C52E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:university_of_washington:alpine:1.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DFD681FD-0E0D-4607-975F-B60B63ED1C07\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:university_of_washington:alpine:2.00:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F6B8E406-E3E3-4C55-A105-79F0365A2283\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:university_of_washington:imap_toolkit:2002:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3F51DEAF-515C-473A-AEEE-4CE8BA8E85ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:university_of_washington:imap_toolkit:2003:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CE4ECFD9-97A9-4B28-B6D8-8BBCA805F0DA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:university_of_washington:imap_toolkit:2004:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2BE5ACC0-5B39-4F5D-ACA2-8098A00E5AB3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:university_of_washington:imap_toolkit:2005:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5A32FBB2-5DCD-4F38-9127-8A2AFDD4A2F8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:university_of_washington:imap_toolkit:2006:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6A532697-4FDB-4A2A-B11A-7BFADB6E7EB5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:university_of_washington:imap_toolkit:2007:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BBC02DF4-1883-4CBA-89A2-422A03CC28B5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:university_of_washington:imap_toolkit:2007c:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CE82091A-6857-4B2B-AA62-056CC14A3707\"}]}]}],\"references\":[{\"url\":\"http://mailman2.u.washington.edu/pipermail/imap-uw/2008-October/002267.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\"]},{\"url\":\"http://mailman2.u.washington.edu/pipermail/imap-uw/2008-October/002268.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://marc.info/?l=full-disclosure\u0026m=122572590212610\u0026w=4\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://panda.com/imap/\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2009-0275.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/32483\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/32512\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/33142\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/33996\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://securityreason.com/securityalert/4570\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://securitytracker.com/id?1021131\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://support.avaya.com/elmodocs2/security/ASA-2009-065.htm\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.bitsec.com/en/rad/bsa-081103.c\",\"source\":\"cve@mitre.org\",\"tags\":[\"URL Repurposed\"]},{\"url\":\"http://www.bitsec.com/en/rad/bsa-081103.txt\",\"source\":\"cve@mitre.org\",\"tags\":[\"URL Repurposed\"]},{\"url\":\"http://www.debian.org/security/2008/dsa-1685\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.mandriva.com/security/advisories?name=MDVSA-2009:146\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.openwall.com/lists/oss-security/2008/11/03/3\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.openwall.com/lists/oss-security/2008/11/03/4\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.openwall.com/lists/oss-security/2008/11/03/5\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/archive/1/498002/100/0/threaded\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/bid/32072\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.vupen.com/english/advisories/2008/3042\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.washington.edu/alpine/tmailbug.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=469667\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\"]},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/46281\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10485\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00058.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00082.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://mailman2.u.washington.edu/pipermail/imap-uw/2008-October/002267.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"http://mailman2.u.washington.edu/pipermail/imap-uw/2008-October/002268.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://marc.info/?l=full-disclosure\u0026m=122572590212610\u0026w=4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://panda.com/imap/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2009-0275.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/32483\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/32512\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/33142\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/33996\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://securityreason.com/securityalert/4570\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://securitytracker.com/id?1021131\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://support.avaya.com/elmodocs2/security/ASA-2009-065.htm\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.bitsec.com/en/rad/bsa-081103.c\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"URL Repurposed\"]},{\"url\":\"http://www.bitsec.com/en/rad/bsa-081103.txt\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"URL Repurposed\"]},{\"url\":\"http://www.debian.org/security/2008/dsa-1685\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.mandriva.com/security/advisories?name=MDVSA-2009:146\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.openwall.com/lists/oss-security/2008/11/03/3\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.openwall.com/lists/oss-security/2008/11/03/4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.openwall.com/lists/oss-security/2008/11/03/5\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/archive/1/498002/100/0/threaded\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/bid/32072\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.vupen.com/english/advisories/2008/3042\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.washington.edu/alpine/tmailbug.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=469667\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/46281\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10485\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00058.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00082.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.