CVE-2007-5467

eXtremail < 2.1.1 - Remote Code Execution via POP3 USER Command Integer Overflow

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 4 public exploits for CVE-2007-5467. PoCs published by mu-b.

AI-analyzed exploit summary This exploit targets a stack overflow vulnerability in eXtremail's ifParseAuthPlain function, allowing remote code execution via a crafted AUTHENTICATE PLAIN command. It includes shellcode for a bind shell and leverages base64 encoding to bypass input restrictions.

Description

Integer overflow in eXtremail 2.1.1 and earlier allows remote attackers to cause a denial of service, and possibly execute arbitrary code, via a long USER command containing "%s" sequences to the pop3 port (110/tcp), which are expanded to "%%s" before being used in the memmove function, possibly due to an incomplete fix for CVE-2001-1078.

Exploits (4)

exploitdb WORKING POC VERIFIED
by mu-b · cremotelinux
https://www.exploit-db.com/exploits/4534

This exploit targets a stack overflow vulnerability in eXtremail's ifParseAuthPlain function, allowing remote code execution via a crafted AUTHENTICATE PLAIN command. It includes shellcode for a bind shell and leverages base64 encoding to bypass input restrictions.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: eXtremail <= 2.1.1
No auth needed
Prerequisites: Network access to the target's IMAP port (143) · Target must be running a vulnerable version of eXtremail
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by mu-b · cremotelinux
https://www.exploit-db.com/exploits/4533

This exploit targets a buffer overflow in the LOGIN command of eXtremail's admin interface, allowing remote code execution. It includes shellcode for a bind shell and is designed for specific versions of eXtremail on Linux.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: eXtremail <= 2.1.1
No auth needed
Prerequisites: Network access to the target's admin interface on port 4501 · Target must be running a vulnerable version of eXtremail
devstral-2 · analyzed Feb 18, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by mu-b · perldoslinux
https://www.exploit-db.com/exploits/4535

This exploit targets a buffer overflow vulnerability in eXtremail <=2.1.1 by sending a crafted payload to the IMAP service on port 143. It attempts to crash the service by sending oversized buffers, demonstrating a denial-of-service condition.

Classification
Working Poc 90%
Attack Type
Dos
Complexity
Trivial
Reliability
Reliable
Target: eXtremail <=2.1.1
No auth needed
Prerequisites: Network access to the target's IMAP service (port 143)
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by mu-b · perldoslinux
https://www.exploit-db.com/exploits/4532

This exploit targets a buffer overflow vulnerability in eXtremail <=2.1.1 via the POP3 USER command. It sends malformed input with varying lengths of NOPs and format specifiers to trigger a crash or potential remote code execution.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Theoretical
Target: eXtremail <=2.1.1
No auth needed
Prerequisites: Network access to the POP3 service (port 110)
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (5)

Core 5
Core References
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/27220
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/26074
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/4532
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/482293

Scores

EPSS 0.1352
EPSS Percentile 96.0%

Details

CWE
CWE-189
Status published
Products (1)
extremail/extremail < 2.1.1
Published Oct 15, 2007
Tracked Since Feb 18, 2026