CVE-2008-5005

Alpine <= 2.00 & IMAP Toolkit 2002-2007c Stack Overflow via Long Folder Extension

Title source: llm
STIX 2.1

Description

Multiple stack-based buffer overflows in (1) University of Washington IMAP Toolkit 2002 through 2007c, (2) University of Washington Alpine 2.00 and earlier, and (3) Panda IMAP allow (a) local users to gain privileges by specifying a long folder extension argument on the command line to the tmail or dmail program; and (b) remote attackers to execute arbitrary code by sending e-mail to a destination mailbox name composed of a username and '+' character followed by a long string, processed by the tmail or possibly dmail program.

References (28)

Core 28
Core References
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10485
URL Repurposed x_refsource_misc
http://www.bitsec.com/en/rad/bsa-081103.txt
Various Sources x_refsource_misc
http://www.washington.edu/alpine/tmailbug.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/46281
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2009:146
Various Sources x_refsource_confirm
http://panda.com/imap/
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2008/11/03/3
URL Repurposed x_refsource_misc
http://www.bitsec.com/en/rad/bsa-081103.c
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2008/11/03/5
Third Party Advisory third-party-advisory x_refsource_sreason
http://securityreason.com/securityalert/4570
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/498002/100/0/threaded
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2008/dsa-1685
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/32483
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/32072
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/33142
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2009-0275.html
Mailing List mailing-list x_refsource_fulldisc
http://marc.info/?l=full-disclosure&m=122572590212610&w=4
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/33996
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/32512
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2008/11/03/4
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2008/3042
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://securitytracker.com/id?1021131

Scores

EPSS 0.0635
EPSS Percentile 92.9%

Details

CWE
CWE-119
Status published
Products (20)
university_of_washington/alpine 0.80
university_of_washington/alpine 0.81
university_of_washington/alpine 0.82
university_of_washington/alpine 0.83
university_of_washington/alpine 0.98
university_of_washington/alpine 0.99
university_of_washington/alpine 0.999
university_of_washington/alpine 0.9999
university_of_washington/alpine 0.99999
university_of_washington/alpine 0.999999
... and 10 more
Published Nov 10, 2008
Tracked Since Feb 18, 2026