CVE-2005-4267
Qualcomm WorldMail 3.0 - Remote Code Execution via Long IMAP Command
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2005-4267.
PoCs published by Metasploit, MC, jduck, including Metasploit module exploits/windows/imap/eudora_list.
AI-analyzed exploit summary This exploit targets a stack buffer overflow in Qualcomm WorldMail 3.0 IMAP Server (builds 6.1.19.0 to 6.1.22.0) via a malformed LIST command. It leverages SEH overwrites and a custom jump payload to achieve remote code execution.
Description
Stack-based buffer overflow in Qualcomm WorldMail 3.0 allows remote attackers to execute arbitrary code via a long IMAP command that ends with a "}" character, as demonstrated using long (1) LIST, (2) LSUB, (3) SEARCH TEXT, (4) STATUS INBOX, (5) AUTHENTICATE, (6) FETCH, (7) SELECT, and (8) COPY commands.
Exploits (3)
This exploit targets a stack buffer overflow in Qualcomm WorldMail 3.0 IMAP Server (builds 6.1.19.0 to 6.1.22.0) via a malformed LIST command. It leverages SEH overwrites and a custom jump payload to achieve remote code execution.
This exploit targets a pre-authentication buffer overflow in Eudora Qualcomm WorldMail 3.0 IMAPd Service 6.1.19.0 via the LIST command. It uses a two-stage shellcode approach to bypass space constraints, ultimately spawning a bind shell on port 4444.
This exploit targets a stack buffer overflow in Qualcomm WorldMail 3.0 IMAP Server (builds 6.1.19.0 to 6.1.22.0) via a malformed LIST command. It leverages SEH overwrites and a custom jump payload to achieve remote code execution.