NetSight
IP …
critical10.0

CVE-2004-1013

The argument parser of the FETCH command in Cyrus IMAP Server 2.2.x through 2.2.8 allows remote authenticated users to execute arbitrary code via certain comma…

Impact

The argument parser of the FETCH command in Cyrus IMAP Server 2.2.x through 2.2.8 allows remote authenticated users to execute arbitrary code via certain commands such as (1) "body[p", (2) "binary[p", or (3) "binary[p") that cause an index increment error that leads to an out-of-bounds memory corruption.

Affected products

VendorProductAffected versions
Carnegie Mellon UniversityCyrus Imap Server
Versions 2.1.7, 2.1.9, 2.1.10, 2.1.16, 2.2.0_alpha, 2.2.1_beta
OpenpkgOpenpkg
Version current
ConectivaLinux
Versions 9.0, 10.0
RedhatFedora Core
Versions core_2.0, core_3.0
TrustixSecure Linux
Versions 2.0, 2.1, 2.2
UbuntuUbuntu Linux
Version 4.1

References