Buffer overflow in qpopper (aka qpop or popper) 4.0 through 4.0.2 allows remote attackers to gain privileges via a long username.

In version 4, a buffer overflow was introduced into the qpopper source tree. This buffer overflow is related to the handling of the client-supplied username and is present when a POP3 session is being initiated. It is believed that the overflow occurs before authentication, so it may not be required that users have valid POP accounts. This vulnerability can lead to a compromise of root privileges to remote attackers.

There are buffer overflow vulnerabilities present in 3.x versions of the Qualcomm popper daemon. These vulnerabilities are remotely executable and since the daemons run as root, the host running qpopper can be completely compromised anonymously.

The remote qpopper service may be vulnerable to a denial of service (DoS) attack. If a string of longer than approximately 2048 characters is sent to the qpopper process, a denial of service condition will occur.

Delegate is reportedly vulnerable to a stack-based buffer overflow that may allow for the execution of arbitrary code. The condition exists if the argument to the 'USER' command is of excessive length. 

The ZetaMail server will crash if a username/password pair longer than 3500 characters is supplied by the client.

The remote qpopper server, according to its banner, is running version 4.0.3 or version 4.0.4.  These versions are vulnerable to a buffer overflow if they are configured to allow the processing of a user's ~/.qpopper-options file. A local user can cause a buffer overflow by setting the bulldir variable to something longer than 256 characters. *** This test could not confirm the existence of the problem - it relied on the banner being returned. ***

The remote Qpopper server, according to its banner, is running version 4.0.3 or version 4.0.4.  These versions are vulnerable to a buffer overflow if they are configured to allow the processing of a user's ~/.qpopper-options file.  A local user can cause a buffer overflow by setting the 'bulldir' variable to something longer than 256 characters.

*** This test could not confirm the existence of the
*** problem - it relied on the banner being returned.

The remote POP3 server might be vulnerable to a buffer overflow bug when it is issued at least one of these commands, with a too long argument :

 AUTH USER PASS

If confirmed, this problem might allow an attacker to execute arbitrary code on the remote system.

ID	Name	Product	Family	Severity
1794	Qualcomm Qpopper Username Remote Overflow	Nessus Network Monitor	POP Server	critical
1793	Qualcomm Qpopper Remote Overflows	Nessus Network Monitor	POP Server	critical
1792	Qualcomm Qpopper Remote Overflow DoS	Nessus Network Monitor	POP Server	critical
1791	Delegate Multiple Function Remote Overflows	Nessus Network Monitor	POP Server	critical
1790	ZetaMail Remote DoS	Nessus Network Monitor	POP Server	critical
1789	qpopper Options File Buffer Overflow	Nessus Network Monitor	POP Server	critical
10948	Qpopper .qpopper-options Username Handling Overflow	Nessus	Misc.	critical
10184	Multiple Vendor POP3 Remote Overflows	Nessus	Gain a shell remotely	critical

Detections

Analytics

CVE-2001-1046

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical