Vulnerabilities > CVE-2005-2878 - Remote Format String vulnerability in GNU Mailutils 0.6

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
gnu
nessus
exploit available
NVD
Published: 2005-09-13
Updated: 2016-10-18

Summary

Format string vulnerability in search.c in the imap4d server in GNU Mailutils 0.6 allows remote authenticated users to execute arbitrary code via format string specifiers in the SEARCH command.

Vulnerable Configurations

Part Description Count
Application
Gnu
1

Exploit-Db

  • descriptionGNU Mailutils imap4d 0.6 (search) Remote Format String Exploit (fbsd). CVE-2005-2878. Remote exploit for bsd platform
    idEDB-ID:1234
    last seen2016-01-31
    modified2005-09-26
    published2005-09-26
    reporterAngelo Rosiello
    sourcehttps://www.exploit-db.com/download/1234/
    titleGNU Mailutils imap4d 0.6 search Remote Format String Exploit fbsd
  • descriptionGNU Mailutils imap4d 0.6 (search) Remote Format String Exploit. CVE-2005-2878. Remote exploit for linux platform
    idEDB-ID:1209
    last seen2016-01-31
    modified2005-09-10
    published2005-09-10
    reporterClément Lecigne
    sourcehttps://www.exploit-db.com/download/1209/
    titleGNU Mailutils imap4d 0.6 search Remote Format String Exploit

Nessus

  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-841.NASL
    descriptionA format string vulnerability has been discovered in GNU mailutils which contains utilities for handling mail that allows a remote attacker to execute arbitrary code on the IMAP server.
    last seen2020-06-01
    modified2020-06-02
    plugin id19845
    published2005-10-05
    reporterThis script is Copyright (C) 2005-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/19845
    titleDebian DSA-841-1 : mailutils - format string vulnerability
  • NASL familyGain a shell remotely
    NASL idGNU_MAILUTILS_SEARCH_FORMAT_STRING.NASL
    descriptionGNU Mailutils is a collection of mail utilities, including an IMAP4 daemon, a POP3 daemon, and a very simple mail client. The remote host is running a version of GNU Mailutils containing a format string vulnerability in its IMAP4 daemon. By exploiting these issues, a remote attacker may be able to execute code remotely in the context of the user executing the daemon process, typically root.
    last seen2020-06-01
    modified2020-06-02
    plugin id19605
    published2005-09-09
    reporterThis script is Copyright (C) 2005-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/19605
    titleGNU Mailutils imap4d Search Command Remote Format String
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-200509-10.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-200509-10 (Mailutils: Format string vulnerability in imap4d) The imap4d server contains a format string bug in the handling of IMAP SEARCH requests. Impact : An authenticated IMAP user could exploit the format string error in imap4d to execute arbitrary code as the imap4d user, which is usually root. Workaround : There are no known workarounds at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id19742
    published2005-09-17
    reporterThis script is Copyright (C) 2005-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/19742
    titleGLSA-200509-10 : Mailutils: Format string vulnerability in imap4d

References