CVE-2005-2933

Description

Buffer overflow in the mail_valid_net_parse_work function in mail.c for Washington's IMAP Server (UW-IMAP) before imap-2004g allows remote attackers to execute arbitrary code via a mailbox name containing a single double-quote (") character without a closing quote, which causes bytes after the double-quote to be copied into a buffer indefinitely.

7.5

CVSS

Severity: High

CVSS 2.0 •

EPSS 35.08% Top 5%

Vendor Advisory mandriva.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory debian.org Vendor Advisory sgi.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory securityfocus.com Vendor Advisory sgi.com Vendor Advisory gentoo.org Vendor Advisory slackware.com Vendor Advisory securityfocus.com Vendor Advisory mandriva.com Vendor Advisory novell.com Vendor Advisory secunia.com Vendor Advisory idefense.com

Affected: n/a n/a

References

Link	Tags
http://www.mandriva.com/security/advisories?name=MDKSA-2005:194	vendor advisory
http://www.redhat.com/support/errata/RHSA-2005-850.html	vendor advisory
http://secunia.com/advisories/17950	third party advisory
http://secunia.com/advisories/21252	third party advisory
http://secunia.com/advisories/17276	third party advisory
http://secunia.com/advisories/17148	third party advisory
http://secunia.com/advisories/20222	third party advisory
http://secunia.com/advisories/20210	third party advisory
http://support.avaya.com/elmodocs2/security/ASA-2006-160.htm
http://secunia.com/advisories/18554	third party advisory
http://securityreason.com/securityalert/47	third party advisory
http://secunia.com/advisories/17152	third party advisory
http://rhn.redhat.com/errata/RHSA-2006-0276.html	vendor advisory
http://www.debian.org/security/2005/dsa-861	vendor advisory
http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0081.html	mailing list patch
http://secunia.com/advisories/17062/	third party advisory patch vendor advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9858	vdb entry signature
ftp://patches.sgi.com/support/free/security/advisories/20051201-01-U	vendor advisory
http://www.securityfocus.com/bid/15009	vdb entry
http://www.washington.edu/imap/	patch
http://www.redhat.com/support/errata/RHSA-2006-0501.html	vendor advisory
http://www.redhat.com/support/errata/RHSA-2005-848.html	vendor advisory
http://rhn.redhat.com/errata/RHSA-2006-0549.html	vendor advisory
http://secunia.com/advisories/20951	third party advisory
http://www.idefense.com/application/poi/display?id=313&type=vulnerabilities&flashstatus=true	third party advisory patch vendor advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/22518	vdb entry
http://support.avaya.com/elmodocs2/security/ASA-2006-129.htm
http://www.securityfocus.com/archive/1/430296/100/0/threaded	vendor advisory
http://secunia.com/advisories/19832	third party advisory
ftp://patches.sgi.com/support/free/security/advisories/20060501-01-U.asc	vendor advisory
http://secunia.com/advisories/17930	third party advisory
http://securitytracker.com/id?1015000	vdb entry
http://www.kb.cert.org/vuls/id/933601	third party advisory us government resource
http://www.gentoo.org/security/en/glsa/glsa-200510-10.xml	vendor advisory
http://slackware.com/security/viewer.php?l=slackware-security&y=2005&m=slackware-security.500161	vendor advisory
http://secunia.com/advisories/21564	third party advisory
http://www.securityfocus.com/archive/1/430303/100/0/threaded	vendor advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2005:189	vendor advisory
http://secunia.com/advisories/17928	third party advisory
http://secunia.com/advisories/17336	third party advisory
http://www.vupen.com/english/advisories/2006/2685	vdb entry
http://secunia.com/advisories/17215	third party advisory
http://www.novell.com/linux/security/advisories/2005_23_sr.html	vendor advisory
http://secunia.com/advisories/17483	third party advisory

Frequently Asked Questions

What is the severity of CVE-2005-2933?: CVE-2005-2933 has been scored as a high severity vulnerability.
How to fix CVE-2005-2933?: To fix CVE-2005-2933, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2005-2933 being actively exploited in the wild?: It is possible that CVE-2005-2933 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~35% probability that this vulnerability will be exploited by malicious actors in the next 30 days.